The miniOrange Discord Integration plugin for PHP contains an improper control of filename vulnerability in its include/require statements, classified as a PHP Local File Inclusion (LFI) issue. This vulnerability affects versions up to and including 2.2.2. The flaw allows an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability. The vulnerability was published on May 23, 2025, but no patch or vendor advisory is currently available. The affected product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by enabling local file inclusion attacks. This may allow attackers to execute arbitrary code, access sensitive files, or disrupt service. The high CVSS score reflects the critical nature of the impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor miniOrange communications for updates and apply patches promptly once available.