This vulnerability in Pixflow Massive Dynamic arises from improper validation of filenames used in PHP include or require statements, leading to remote file inclusion (RFI). An attacker could exploit this to include malicious files from remote servers, resulting in remote code execution. The issue affects all versions up to 8.2. The CVSS 3.1 base score is 9.0, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code remotely on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. This could lead to full system compromise or data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from Pixflow. No official patch or workaround information is currently provided.