This vulnerability (CVE-2025-69116) affects ThemeREX Iona versions <= 1.0.8 and is categorized as CWE-98, indicating improper control of filenames in PHP include/require statements. An unauthenticated attacker can exploit this local file inclusion flaw to potentially execute arbitrary code or access sensitive files. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service. The vulnerability is exploitable remotely without authentication, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks.