This vulnerability in PDF-Rechnungsverwaltung involves improper limitation of a pathname to a restricted directory, leading to a path traversal condition. This flaw allows an attacker to perform PHP Local File Inclusion, which can lead to disclosure or execution of arbitrary local files. The affected versions are up to 0.0.1. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges but user interaction with high attack complexity.

Successful exploitation could allow an unauthenticated remote attacker to include and potentially execute arbitrary local files on the affected system, leading to full compromise of confidentiality, integrity, and availability of the application and underlying system. This could result in data leakage, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is currently available. Users should monitor mh6webentwicklung communications for updates and consider restricting access to the affected application until a fix is released.