The vulnerability identified as CVE-2025-58941 affects the Fabric product by axiomthemes, versions up to and including 1.5.0. It is caused by improper control over the filename used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to read sensitive files or execute arbitrary code depending on the server configuration. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server running the affected Fabric versions, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect and block suspicious include/require requests, and monitoring for unusual activity related to file inclusion attempts. Avoid deploying affected versions in production environments if possible.