This vulnerability (CVE-2025-69170) is classified under CWE-98, indicating improper control of filenames used in include or require statements in PHP code. In ThemeREX Eventicity versions <= 1.5, an unauthenticated attacker can exploit this flaw to perform local file inclusion, which may result in remote code execution or disclosure of sensitive files. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high confidentiality, integrity, and availability impacts, but requiring high attack complexity and no privileges or user interaction.

Successful exploitation allows an unauthenticated attacker to include arbitrary local files on the server running Eventicity <= 1.5. This can lead to remote code execution, full system compromise, data disclosure, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to vulnerable versions and consider disabling or restricting the affected functionality if possible.