CVE-2026-51925 describes a Local File Inclusion vulnerability in docuForm GmbH Client v11.11c. The vulnerability is located in the dfm-menu_report.php component and enables remote attackers to include and read arbitrary files from the server. This can lead to disclosure of sensitive information such as configuration files and source code. The vulnerability is confirmed published but lacks a CVSS score and any vendor-provided remediation details. No known exploits have been reported.

Successful exploitation allows an attacker to read arbitrary files on the affected server, which may include sensitive configuration data, source code, or system files. This can lead to information disclosure and potentially facilitate further attacks. There is no indication of direct code execution beyond file inclusion, but arbitrary code execution is suggested in the description, which would increase impact severity if confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component and limit exposure of the affected system to untrusted networks. Monitor vendor communications for updates on patches or mitigations.