The vulnerability CVE-2026-22364 affects axiomthemes SevenTrees (<=1.0.2) and is characterized by improper control of the filename parameter in PHP include or require statements. This flaw allows PHP Local File Inclusion, enabling an attacker to include and execute local files on the server. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized modification of data, and disruption of service due to the ability to include arbitrary local files on the server. This can result in full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor official sources for updates regarding patches or mitigations.