PT-2025-25695 · Unknown · Thembay Lasa

Phat Rio - Bluerock · Published 2025-06-17 · Updated 2025-06-17 · CVE-2025-49253

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thembay Lasa versions 1.1 and earlier

Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a type of security vulnerability that can be exploited by manipulating the filename used in include or require statements in PHP programs.

Recommendations For thembay Lasa versions 1.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-49253

Affected Products

Thembay Lasa

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-49253 · Security Note
• https://twitter.com/CVEnew/status/1934999224002711946 · Twitter Post
• https://patchstack.com/database/wordpress/theme/lasa/vulnerability/wordpress-lasa-1-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Theme/lasa/vulnerability/wordpress-lasa-1-1-local-file-inclusion-vulnerability?_s_id=cve · Note