This vulnerability in MadrasThemes MAS Videos arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with limited privileges to include arbitrary local files, potentially leading to code execution or disclosure of sensitive information. The affected versions are up to and including 1.3.4. The CVSS 3.1 vector indicates network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or disclose sensitive files by including local files through the vulnerable PHP statements. This poses a significant risk to systems running vulnerable versions of MAS Videos.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and review PHP configurations to limit file inclusion risks. Avoid exposing the application to untrusted networks or users with low privileges. Monitor for updates from MadrasThemes regarding patches or mitigations.