This vulnerability in Creativeitem Doctor Appointment Booking arises from improper validation or control of filenames passed to PHP include/require statements, resulting in a Local File Inclusion issue. The vulnerability affects versions up to 1.0.0. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The issue was reserved and published in early 2025. No patch or vendor advisory details are currently provided.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the server, potentially leading to disclosure of sensitive information, modification of data, or denial of service. The CVSS score indicates a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected application and limiting privileges may reduce risk.