This vulnerability (CVE-2025-69159) affects ThemeREX Printo software versions up to and including 1.11. It is caused by improper control of filenames used in PHP include or require statements, categorized under CWE-98. The flaw allows unauthenticated attackers to perform local file inclusion, which can lead to remote file inclusion attacks. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or official remediation level has been published by the vendor at this time.

Successful exploitation can lead to remote code execution, full system compromise, and unauthorized access to sensitive data due to the ability to include arbitrary files on the server. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and consider disabling or restricting PHP include/require functionality if feasible. Monitor for vendor updates and apply patches promptly once released.