This vulnerability in jwsthemes FreeAgent arises from improper validation or control of filenames used in PHP include or require statements, enabling an attacker to perform Local File Inclusion (LFI). Exploiting this flaw can allow an attacker to include arbitrary files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The affected versions include all releases up to and including 2.1.2. The CVSS 3.1 vector indicates the attack is remotely exploitable over the network without privileges or user interaction but requires high attack complexity.

Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the affected system. Attackers may read sensitive files, execute arbitrary code, or disrupt service. The vulnerability is rated high severity with a CVSS score of 8.1, reflecting significant potential impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider applying workarounds such as disabling vulnerable functionality or restricting access to affected components if possible. Monitor official jwsthemes communications for updates.