CVE-2025-69133 is a Local File Inclusion vulnerability in GoodLayers Tourmaster, affecting versions up to 5.4.5. It arises from improper control of filenames in PHP include/require statements (CWE-98). An attacker with network access and low privileges can exploit this vulnerability without user interaction, but with high attack complexity. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on affected installations of Tourmaster. The attacker can include arbitrary local files, potentially executing malicious code or accessing sensitive configuration files, resulting in a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and apply any recommended vendor mitigations if available. Monitor for updates from GoodLayers regarding patches or workarounds.