The vulnerability CVE-2024-44014 affects Vmax Studio's Vmax Project Manager up to version 1.0. It is caused by improper limitation of pathnames to restricted directories, enabling path traversal attacks. This flaw allows PHP Local File Inclusion, which can be exploited remotely without privileges and requires user interaction. The CVSS 3.1 base score is 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full system compromise, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The critical CVSS score reflects the high potential impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application, apply strict input validation where possible, and monitor for suspicious activity related to file inclusion attempts.