The vulnerability CVE-2025-53438 in axiomthemes FitLine (versions up to 1.6) is caused by improper control over filenames used in PHP include or require statements. This flaw allows PHP Local File Inclusion, enabling attackers to include local files on the server, potentially leading to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 base score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The vulnerability was published on December 18, 2025. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, which may result in disclosure of sensitive information, code execution, or full compromise of the affected system. The high CVSS score indicates severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect file inclusion attempts, and reviewing application code for insecure include/require usage. Monitor vendor channels for updates and patches.