The vulnerability CVE-2024-44017 affects MH Board by MinHyeong Lim, allowing improper limitation of pathnames to restricted directories. This path traversal flaw enables PHP Local File Inclusion, potentially allowing remote attackers to include and execute arbitrary files on the server. The issue affects versions up to and including 1.3.2.1. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files via PHP, leading to disclosure of sensitive information, modification of data, or denial of service. The impact is rated high due to the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as restricting access to vulnerable endpoints or disabling affected functionality if possible.