The vulnerability CVE-2025-60049 in axiomthemes Soleil arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary file disclosure or code execution depending on the context. The affected versions include all versions up to and including 1.17. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or execution of arbitrary code on the affected system. This compromises the confidentiality, integrity, and availability of the impacted system. There are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall (WAF) rules to detect and block suspicious include/require requests may help mitigate risk.