This vulnerability in ThemeREX FreightCo (<= 1.1.7) arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The issue allows an attacker to potentially execute arbitrary code or access sensitive files by manipulating the filename parameter in the PHP program.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files due to the Local File Inclusion vulnerability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor ThemeREX advisories for updates and consider applying any forthcoming patches promptly. Until a patch is available, restricting access to vulnerable endpoints and employing web application firewalls with rules targeting Local File Inclusion attempts may reduce risk.