CVE-2025-58928 describes a vulnerability in the axiomthemes Heart PHP application where improper control over the filename used in include or require statements allows for PHP Local File Inclusion. This flaw exists in versions up to 1.8 and can be exploited remotely over the network without authentication or user interaction, though it requires high attack complexity. Successful exploitation can lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability has a CVSS v3.1 base score of 8.1. No patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability. Given the high CVSS score and network attack vector, this represents a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying strict input validation and restricting file inclusion paths may mitigate risk but are not confirmed as complete mitigations for this issue.