The vulnerability CVE-2026-22365 in axiomthemes Soleng (<= 1.0.5) is due to improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary file disclosure or code execution depending on the context. The vulnerability is remotely exploitable without authentication and requires no user interaction. It is rated critical with a CVSS 3.1 base score of 9.8, reflecting high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including disclosure of sensitive files, execution of arbitrary code, and potential system takeover. The critical CVSS score (9.8) reflects the high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable functionality if possible, and monitor for updates from axiomthemes. No official patch or workaround information is currently provided.