The vulnerability CVE-2025-69041 in goalthemes Dekoro (<= 1.0.7) is due to improper control of the filename parameter in PHP include/require statements, enabling Local File Inclusion (LFI). This can allow attackers to include and execute arbitrary files on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction. No patch or mitigation details are currently available from the vendor or public advisories.

Successful exploitation can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, and fully compromise the affected system's confidentiality, integrity, and availability. The CVSS score of 8.1 confirms a high impact. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and applying any available workarounds from the vendor. Monitor vendor channels for updates and apply patches promptly once released.