The vulnerability CVE-2025-69047 affects magentech MaxShop versions up to 3.6.20 and is caused by improper control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, potentially allowing an attacker to include and execute local files within the application context. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or official remediation information is currently available.

Successful exploitation can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or disrupt application operations. The high CVSS score indicates a serious risk to confidentiality, integrity, and availability of the affected system. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying general PHP hardening practices relevant to file inclusion vulnerabilities.