The vulnerability CVE-2025-60066 in axiomthemes Katelyn (<= 1.0.10) arises from improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion flaw. This allows attackers to potentially include arbitrary files on the server, which can lead to remote code execution or information disclosure. The CVSS 3.1 base score of 8.1 reflects high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to unauthorized file inclusion on the affected server, potentially allowing attackers to execute arbitrary code, disclose sensitive information, or disrupt service. The high CVSS score (8.1) indicates a significant risk to confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying strict input validation, and employing web application firewalls to mitigate potential exploitation. Monitor vendor channels for updates regarding patches or official mitigations.