This vulnerability (CVE-2025-69172) involves an unauthenticated local file inclusion (LFI) in ThemeREX Resurs software versions up to and including 1.3. The root cause is improper control of filenames in PHP include/require statements, enabling attackers to include arbitrary local files. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to include and execute arbitrary local files on the server running ThemeREX Resurs <= 1.3. This can lead to full compromise of the system's confidentiality, integrity, and availability, potentially resulting in data disclosure, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and consider disabling or restricting PHP include/require functionality if feasible. Monitor vendor channels for updates and apply patches promptly once released.