This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the PHP-based ThemeREX Choreo product. Specifically, unauthenticated attackers can exploit this local file inclusion flaw in versions up to and including 1.6, potentially allowing them to execute arbitrary code or access sensitive files. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification or deletion of data, and disruption of service. The vulnerability affects confidentiality, integrity, and availability with high severity as indicated by the CVSS score of 8.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to vulnerable endpoints and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks if possible.