The vulnerability CVE-2025-58889 in axiomthemes Towny (versions <= 1.16) is caused by improper control of the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include arbitrary local files on the server. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official fix information is available from the vendor or advisory sources. The vulnerability is published and reserved as of late 2025, with no known exploits in the wild.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, modify application behavior, or cause denial of service, impacting confidentiality, integrity, and availability. Given the high CVSS score, the impact is considered severe. However, no active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to affected endpoints and applying web application firewall (WAF) rules to detect and block attempts to exploit file inclusion. Avoid exposing the vulnerable application to untrusted networks if possible.