This vulnerability in gavias Kipso (<= 1.3.4) arises from improper validation of filenames in PHP include/require statements, leading to PHP Local File Inclusion. An attacker could exploit this to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score of 8.1 reflects high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or official fix information is currently provided by the vendor, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, and service disruption. The high CVSS score indicates significant risk to confidentiality, integrity, and availability of the affected system. No known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules targeting file inclusion attacks, and limiting file permissions to reduce potential impact. Monitor official gavias advisories for updates and apply patches promptly once released.