The vulnerability CVE-2026-25379 in jwsthemes StreamVid arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary local files on the affected server, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects StreamVid versions before 6.8.6. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on all three security properties. No patch or official fix details are currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include and execute arbitrary local files on the server running StreamVid, potentially leading to full system compromise including data disclosure, modification, or denial of service. The high CVSS score reflects the severity of these impacts. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to affected StreamVid installations and applying any recommended configuration changes to limit file inclusion risks. Monitor vendor channels for updates and patches addressing this vulnerability.