This vulnerability in hockeydata LOS (<= 1.2.4) arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. An attacker could exploit this to include unintended local files, which may disclose sensitive information or allow code execution depending on the server environment. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction needed.

Successful exploitation could lead to disclosure of sensitive local files, unauthorized code execution, and disruption of service in hockeydata LOS installations. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates and consider implementing temporary mitigations such as restricting file inclusion paths or disabling remote file inclusion features if configurable.