This vulnerability in axiomthemes Spock (versions up to 1.17) involves improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. The CVSS score of 8.1 reflects a high-severity issue with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is currently provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability, making this a critical risk for affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor official axiomthemes communications for updates.