This vulnerability (CVE-2025-69160) in ThemeREX Gita involves improper control of filenames used in PHP include or require statements, classified as CWE-98. It allows an unauthenticated attacker to perform local file inclusion, potentially leading to remote file inclusion attacks. The affected versions are Gita up to and including 1.11. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges or user interaction, and results in high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation can lead to remote file inclusion, allowing attackers to execute arbitrary code, compromise system confidentiality, integrity, and availability. Since the vulnerability is unauthenticated, it can be exploited remotely without credentials. The high CVSS score reflects the critical nature of the impact on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.