This vulnerability, identified as CWE-98, arises from improper control of filenames in include or require statements within the PHP-based ThemeREX Eros product. It allows unauthenticated attackers to perform local file inclusion (LFI) on Eros versions up to 1.3, potentially leading to remote code execution or information disclosure. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service. The vulnerability affects confidentiality, integrity, and availability of the system running the vulnerable Eros versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted networks where possible.