The vulnerability CVE-2025-53453 in axiomthemes Hygia arises from improper validation of filenames used in PHP include or require statements, enabling Local File Inclusion attacks. This allows an attacker to cause the application to include files from the local filesystem, which can lead to disclosure of sensitive information, code execution, or denial of service. The affected versions include all releases up to and including 1.16. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may read sensitive files, execute arbitrary code, or disrupt service. The high CVSS score (8.1) indicates significant risk if exploited. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor axiomthemes advisories for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewalls with rules targeting LFI attempts may help mitigate risk.