The vulnerability CVE-2025-60067 in axiomthemes Giardino (versions up to 1.1.10) is due to improper control of filenames in PHP include/require statements, causing a PHP Local File Inclusion issue. This flaw allows an attacker to manipulate file inclusion paths, potentially leading to arbitrary code execution or information disclosure. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability could allow remote attackers to include local files on the server, leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score indicates a significant risk to affected systems. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.