This vulnerability in EverPress Mailster (<= 4.0.6) is due to improper validation or control of filenames used in PHP include or require statements, enabling remote file inclusion. An attacker could exploit this to execute arbitrary code remotely by including malicious files. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impacts including partial confidentiality loss, high integrity loss, and low availability loss. No patch or official fix information is currently available, and the product is not a cloud service.

Successful exploitation could allow remote attackers to execute arbitrary code on the affected server, potentially leading to data compromise, system integrity loss, and partial denial of service. The vulnerability affects confidentiality, integrity, and availability to varying degrees as indicated by the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include requests, and monitoring for unusual activity related to file inclusion attempts. Avoid exposing the affected Mailster installation to untrusted networks if possible.