The vulnerability CVE-2026-22363 in axiomthemes Rhodos arises from improper validation or control of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can be exploited to execute arbitrary code or disclose sensitive information by including unintended files. The issue affects Rhodos versions up to 1.3.3. The CVSS v3.1 score is 8.1, indicating a high impact with network attack vector, high complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files by including local files through the vulnerable PHP include/require statements. There are no known exploits in the wild currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying PHP hardening measures specific to file inclusion vulnerabilities.