This vulnerability in trippleS Digiqole arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. Affected versions are those before 2.2.7. The vulnerability allows an attacker with low privileges to include local files, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive local files, unauthorized code execution, and disruption of service in affected Digiqole installations. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided, users should monitor trippleS communications for updates. Until a fix is available, restricting access to the vulnerable application and limiting privileges may reduce risk.