This vulnerability in ThemeREX Cobble arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion (LFI). An attacker could exploit this to include arbitrary files on the server, potentially leading to code execution or disclosure of sensitive information. The issue affects Cobble versions up to and including 1.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to include local files on the server, which can lead to disclosure of sensitive data, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score (8.1), the impact is severe. However, there are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from ThemeREX. No official patch or workaround information is currently available.