This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the PHP-based ThemeREX Gamic product. Specifically, unauthenticated attackers can exploit local file inclusion in versions up to 1.15, allowing them to include arbitrary files on the server. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation can lead to remote file inclusion, enabling attackers to execute arbitrary code, disclose sensitive information, modify data, or disrupt service availability. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable versions to untrusted networks.