CVE-2026-51925 describes a Local File Inclusion vulnerability in docuForm GmbH Client version 11.11c. The vulnerability exists in the dfm-menu_report.php component and allows a remote attacker with low privileges to include and execute arbitrary files on the server. Exploitation can lead to disclosure of sensitive files such as configuration files, source code, or system files. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact without availability impact. No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker with limited privileges to read arbitrary files on the affected server, potentially exposing sensitive configuration data, source code, or system files. This can lead to further compromise of the system or unauthorized disclosure of confidential information. The vulnerability does not impact availability but has high confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component and limit user privileges to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.