CVE-2025-69171 is an unauthenticated local file inclusion vulnerability in ThemeREX Orpheus version 1.3 and earlier. It arises from improper control of filenames used in PHP include or require statements (CWE-98). This weakness can be exploited remotely without authentication, allowing attackers to include arbitrary files, potentially leading to full confidentiality, integrity, and availability compromise. The vulnerability has a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation can lead to remote file inclusion, enabling attackers to execute arbitrary code, access sensitive data, and disrupt service availability. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable installations and consider applying temporary mitigations such as disabling vulnerable functionality or restricting file inclusion paths if possible.