The vulnerability CVE-2025-58803 in axiomthemes Algenix (<= 1.0) arises from improper control of the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) issue. This allows an attacker to manipulate the filename input to include unintended local files on the server. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction. No patch or official fix information is available, and no exploits have been observed in the wild. The vulnerability affects the product in on-premises deployments.

Successful exploitation of this vulnerability could allow an attacker to read sensitive local files or execute arbitrary code within the context of the web server, potentially compromising confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is significant if exploited. However, no known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include/require requests may help mitigate risk.