The vulnerability CVE-2025-69399 affects ThemeREX Cobble up to version 1.7 and is caused by improper validation of filenames used in PHP include or require statements. This improper control can lead to Local File Inclusion (LFI), where an attacker can cause the application to load unintended local files. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or vendor advisory is available at this time, and the product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is severe if exploited. However, the attack complexity is high, which may limit exploitability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor ThemeREX communications for updates. Until a fix is available, consider applying manual code reviews or temporary mitigations such as restricting file inclusion paths or disabling vulnerable functionality if feasible.