The vulnerability CVE-2025-53439 in axiomthemes Harper arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), potentially enabling unauthorized access to sensitive files or code execution within the affected application. The issue affects Harper versions up to 1.13. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is released, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor once available.