The vulnerability CVE-2026-25017 affects stmcan NaturaLife Extensions up to version 2.1 and is caused by improper control of filenames in PHP include or require statements. This can lead to PHP Local File Inclusion, where an attacker may trick the application into including unintended local files, potentially leading to code execution or information disclosure. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, which may lead to arbitrary code execution, data disclosure, or denial of service. The high CVSS score indicates that the impact on confidentiality, integrity, and availability is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the vulnerable NaturaLife Extensions or applying configuration changes to limit file inclusion capabilities if possible. Monitor vendor channels for updates.