The vulnerability CVE-2025-60050 in axiomthemes Panda arises from improper validation of filenames used in PHP include or require statements, allowing PHP Local File Inclusion. This flaw affects Panda versions up to 1.21. Exploitation can lead to high impact on confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 8.1 with network attack vector, high attack complexity, no privileges or user interaction required. No patch or official remediation guidance is currently provided, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability can lead to unauthorized inclusion of local files, potentially exposing sensitive information, executing arbitrary code, or causing denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions and applying general PHP security best practices related to file inclusion. Monitor vendor channels for updates and patches.