This vulnerability in gavias Indutri involves improper control over the filename parameter used in PHP include or require statements, which can lead to Local File Inclusion (LFI). LFI vulnerabilities allow an attacker to include files on the server, potentially exposing sensitive information or enabling further code execution. The issue affects all versions before 1.3.0. The CVSS 3.1 base score of 8.1 reflects network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive data, code execution, or denial of service. The high CVSS score indicates a serious impact on system confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require parameters may help mitigate risk.