This vulnerability in AncoraThemes Palladio arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow attackers to include and execute local files on the server, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system. The issue affects Palladio versions up to 1.1.10. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution, disclosure of sensitive information, and disruption of service on affected systems running vulnerable versions of Palladio. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and review PHP include/require usage in their Palladio installations. Monitor official AncoraThemes communications for patches or updates addressing this issue.