The vulnerability CVE-2025-53252 in zozothemes Zegen involves improper control of the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This allows an attacker to include unintended files from the local filesystem, potentially leading to disclosure of sensitive information, code execution, or denial of service. The issue affects all versions through 1.1.9. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild or available patches.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, or disrupt service on affected systems running vulnerable versions of zozothemes Zegen. The impact is rated high due to the potential compromise of confidentiality, integrity, and availability. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application, applying web application firewall rules to block suspicious requests targeting include/require parameters, and reviewing application configurations to limit file inclusion paths.