The vulnerability CVE-2025-60058 affects AncoraThemes DetailX versions up to 1.10.0. It arises from improper control over the filename parameter in PHP include or require statements, leading to PHP Local File Inclusion. This can allow attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no information about an available patch or official vendor remediation.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, and service disruption. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as restricting access to vulnerable endpoints, disabling vulnerable functionality if possible, or employing web application firewalls to detect and block suspicious requests related to file inclusion attempts.