The vulnerability CVE-2025-53447 affects the Assembly product by axiomthemes, where improper validation of filenames used in PHP include or require statements leads to a Local File Inclusion (LFI) issue. This can allow an attacker to include unintended files on the server, potentially leading to code execution or information disclosure. The affected versions include all releases up to and including version 1.1. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available from the vendor or other sources.

Successful exploitation of this vulnerability can lead to arbitrary code execution and disclosure of sensitive information on affected systems running Assembly up to version 1.1. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable components and applying general PHP security best practices to limit exposure. Monitor vendor communications for updates on patches or official mitigations.