This vulnerability in Alexander AnyComment (<= 0.3.6) arises from improper control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive information, modification of data, and disruption of service on the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable AnyComment versions and avoid exposing the application to untrusted users. Monitor vendor channels for updates.