The vulnerability CVE-2025-69040 in goalthemes Bfres (versions <= 1.2.1) is caused by improper control of the filename parameter in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can manipulate the filename to include arbitrary files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files or execute arbitrary code on the affected system, resulting in full compromise of the system's confidentiality, integrity, and availability. The high CVSS score (8.1) reflects the critical nature of the impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds from the vendor. Monitor official goalthemes communications for updates on patches or mitigations.