The vulnerability CVE-2025-53326 in CodeYatri Gutenify arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), where local files on the server can be included and executed by the PHP interpreter. The affected versions are all releases up to and including 1.5.4. The CVSS v3.1 base score is 7.5, reflecting a high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity. No patch or official fix information is currently available.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, code execution, and potentially full system compromise due to the ability to include arbitrary local files. The attack requires network access and low privileges but has a high impact on confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable application and consider disabling or limiting the use of the Gutenify plugin. Monitor for updates from CodeYatri regarding patches or mitigations. Avoid exposing the vulnerable application to untrusted networks where possible.