The dedalx Cook&Meal application versions up to 1.2.3 contain a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control allows a PHP Local File Inclusion attack, enabling an attacker to include local files on the server. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to disclosure of sensitive files, modification of application behavior, or denial of service, severely impacting the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the significant risk posed by this vulnerability if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to affected versions and applying any recommended configuration changes from the vendor to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.