This vulnerability (CVE-2025-69369) in Axiomthemes Racquet arises from improper validation of filenames used in PHP include or require statements, categorized under CWE-98. It enables PHP Local File Inclusion, which can allow attackers to execute arbitrary code or disclose sensitive information by including unintended files. The issue affects Racquet versions through 1.12.0. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. No patch or official remediation level is currently documented, and no known exploits have been reported.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion via PHP include/require statements. This can allow attackers to execute arbitrary code or access sensitive files. The vulnerability is rated high severity with a CVSS score of 8.1. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Axiomthemes' advisories for updates. Until a fix is available, consider restricting access to vulnerable components and employing web application firewalls or other controls to limit exploitation opportunities.