The vulnerability CVE-2025-58934 affects axiomthemes The Gig up to version 1.18.0. It arises from improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include and execute arbitrary local files on the server running The Gig, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized access to sensitive data, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and applying any recommended temporary mitigations from the vendor once published. Avoid exposing vulnerable versions to untrusted networks.