The vulnerability CVE-2025-53449 in axiomthemes Convex arises from improper control over filenames used in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability. This affects Convex versions up to 1.11. The CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the vulnerability is exploitable remotely without privileges or user interaction but requires high attack complexity. Successful exploitation can result in high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can lead to local file inclusion, allowing an attacker to read sensitive files, execute arbitrary code, or disrupt service, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying strict input validation may help reduce risk, but these are not confirmed mitigations from the vendor.