The temash Barberry product up to version 2.9.9.87 suffers from an improper control of filename in PHP include/require statements, classified as a PHP Local File Inclusion vulnerability. This allows an attacker to manipulate file inclusion paths, potentially executing arbitrary local files on the server. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability, but with high attack complexity and no required privileges or user interaction. No patch or vendor advisory information is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could lead to local file inclusion, allowing attackers to execute arbitrary code or disclose sensitive information stored on the server. This impacts confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 confirms a high severity level. However, no known exploits have been reported, and the attack complexity is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available workarounds from the vendor. Monitor official temash communications for updates on patches or mitigations.