The vulnerability CVE-2025-58946 in axiomthemes Vocal arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform remote file inclusion, potentially executing arbitrary code on the affected system. The issue affects Vocal versions up to 1.12. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code on the server hosting the vulnerable Vocal application. This compromises confidentiality, integrity, and availability of the system. The high CVSS score reflects the critical nature of this vulnerability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor official axiomthemes channels for updates regarding patches or mitigations.