This vulnerability involves improper control of the filename parameter in PHP include or require statements within the Select-Themes Dessau product before version 1.9. It allows PHP Local File Inclusion, which can be exploited by an attacker with low privileges over the network to include arbitrary local files. The vulnerability affects all versions prior to 1.9 and has a CVSS v3.1 score of 7.5, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS vector indicates network attack vector with high impact on confidentiality, integrity, and availability, requiring low privileges and no user interaction. This could result in significant compromise of affected systems running vulnerable versions of Dessau.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and limit privileges of users interacting with it. Monitor for updates from Select-Themes regarding patches or mitigations for this vulnerability.