The vulnerability CVE-2025-58913 affects CactusThemes VideoPro versions up to 2.3.8.1 and is caused by improper control over filenames used in PHP include or require statements. This leads to PHP Local File Inclusion, enabling an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability can result in local file inclusion, potentially allowing attackers to execute arbitrary code, access sensitive files, or disrupt service. The impact affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild, but the high CVSS score indicates a serious security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor for vendor updates and consider restricting access to vulnerable components or applying manual code review and hardening to control file inclusion paths until a patch is available.