This vulnerability in Hossein Material Dashboard (<= 1.4.5) arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion. An attacker could exploit this to include and execute arbitrary files on the server, potentially compromising system confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1, reflecting network attack vector with high impact and no privileges or user interaction required. No patch or official remediation details are currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker to read sensitive files or execute arbitrary code on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running Hossein Material Dashboard versions up to 1.4.5. The high CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall rules to detect and block suspicious include requests, and reviewing server configurations to limit file inclusion risks. Monitor vendor channels for updates and apply patches promptly once available.