The vulnerability CVE-2025-69342 affects VanKarWai Calafate through improper control of filenames in PHP include/require statements, leading to PHP Local File Inclusion. This can allow an attacker with limited privileges to include unintended files, potentially leading to code execution or information disclosure. The affected versions include all versions up to 1.7.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service due to local file inclusion. The high CVSS score reflects the potential for significant impact on the affected system's security posture. No known active exploits have been reported, but the vulnerability poses a serious risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted inputs that could influence file inclusion paths.