The vulnerability CVE-2025-58929 in axiomthemes Pantry arises from improper validation of filenames used in PHP include or require statements, enabling Local File Inclusion. This can allow attackers to read or execute arbitrary files on the server hosting Pantry versions up to 1.4. The CVSS 3.1 base score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction. The vulnerability was published on December 18, 2025, and no patch or official fix has been documented. The product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score and the nature of Local File Inclusion, attackers could potentially leverage this flaw to escalate privileges or disrupt service. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable functionality, applying strict input validation on filenames used in include/require statements, or isolating the affected application to limit potential damage. Monitor vendor channels for updates and apply patches promptly once available.