This vulnerability involves improper control of the filename parameter in PHP include or require statements within the Nasa Core product by NasaTheme. Specifically, it allows local file inclusion (LFI), which can enable an attacker to include and execute arbitrary files on the server. The affected versions are all versions before 6.4.4. The CVSS 3.1 score is 7.5, indicating a high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service due to the ability to include local files improperly. This can compromise the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to vulnerable endpoints and limiting privileges may reduce risk.