This vulnerability (CVE-2025-69113) is classified as CWE-98, indicating improper control of filenames used in PHP include or require statements. It affects ThemeREX Nexio versions up to 1.10.0 and allows unauthenticated attackers to perform Local File Inclusion (LFI). The vulnerability arises from insufficient validation or sanitization of input used to specify files for inclusion, enabling attackers to include arbitrary local files. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected server by including malicious or sensitive local files. This compromises the confidentiality, integrity, and availability of the system and data. Because the vulnerability is exploitable without authentication, it poses a significant risk to exposed installations of Nexio up to version 1.10.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations, disable vulnerable functionality if possible, and monitor for suspicious activity. Avoid exposing the affected application to untrusted networks. Follow vendor updates closely for an official patch or mitigation.