This vulnerability (CVE-2025-69145) in ThemeREX Gat (versions up to 1.16) is an unauthenticated local file inclusion (LFI) issue caused by improper control of the filename used in PHP include/require statements (CWE-98). An attacker can exploit this flaw remotely without any privileges or user interaction to include arbitrary local files, which can lead to remote code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor or authoritative sources as of the data provided.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers can include arbitrary local files, potentially leading to remote code execution, data disclosure, or denial of service. The vulnerability is exploitable remotely without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable application to untrusted networks. Do not rely on generic mitigations unless specifically recommended by the vendor.