The vulnerability identified as CVE-2025-60048 affects the Tripster product by axiomthemes. It arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion attacks. This can allow attackers to execute arbitrary code or access sensitive files on the affected system. The issue impacts versions up to 1.0.10. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files by including local files via manipulated PHP include/require statements. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to affected systems and reviewing PHP configurations to limit file inclusion risks. Avoid exposing vulnerable endpoints publicly if possible.