This vulnerability arises from improper validation or control of filenames in PHP include or require statements within the Ray Enterprise Translation software. Specifically, it allows PHP Local File Inclusion, enabling an attacker to include and execute local files on the server. The CVSS score of 7.5 indicates a high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity. The affected versions include all versions up to and including 1.7.1. No patch or official fix details are currently available, and the product is not a cloud service.

Successful exploitation could lead to disclosure of sensitive information, modification of data, or disruption of service due to local file inclusion. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and carefully validate or sanitize input that controls file inclusion. Monitor vendor channels for updates regarding patches or official mitigations.