The vulnerability CVE-2024-44013 affects VR Calendar by Innate Images LLC, specifically in the vr-calendar-sync feature. It is caused by improper limitation of a pathname to a restricted directory, enabling path traversal attacks that lead to PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially resulting in full system compromise. The issue affects all versions up to and including 2.4.0. The vulnerability has a CVSS v3.1 base score of 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code on the affected system. This can compromise confidentiality, integrity, and availability of the system running VR Calendar. There are no reports of known exploits in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vr-calendar-sync component and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks or users.