This vulnerability arises from improper validation of filenames in PHP include/require statements within Ray Enterprise Translation software. Specifically, it allows Local File Inclusion (LFI), enabling an attacker to include and execute arbitrary files on the server. The affected versions are up to and including 1.7.0. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service. The attacker could execute arbitrary code or access sensitive files on the affected system, severely impacting system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Users should monitor for vendor updates and apply any official fixes once available. Until then, restricting access to the affected application and limiting user interaction may reduce risk.