This vulnerability in trippleS Exhibz arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion (LFI). An attacker with low privileges can exploit this flaw remotely over the network, but the attack complexity is high. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system. The issue affects Exhibz versions up to and including 3.0.9. No vendor patch or advisory is currently available to confirm remediation status.

Exploitation of this vulnerability can result in disclosure of sensitive files, execution of arbitrary code, and disruption of service on affected systems running Exhibz up to version 3.0.9. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction needed, and impacts to confidentiality, integrity, and availability rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Exhibz application to trusted users only and consider disabling or restricting PHP include/require functionality if possible. Monitor for any vendor updates or patches addressing this vulnerability.