The vulnerability CVE-2025-58935 in axiomthemes Lunna arises from improper validation or control of filenames used in PHP include or require statements. This flaw permits PHP Local File Inclusion, enabling attackers to include and execute arbitrary local files on the server. The affected versions are from initial releases through 1.15. The CVSS v3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The impact is rated high due to the potential for full system compromise. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and consider applying temporary mitigations such as restricting access to vulnerable endpoints or disabling the affected functionality if possible until a fix is available.