CVE-2026-22366 describes a vulnerability in the axiomthemes Jude PHP application where improper control of filenames in include or require statements allows for PHP Local File Inclusion. This flaw exists in versions up to 1.3.0 and could enable attackers to execute unauthorized code or access sensitive files by manipulating the file inclusion mechanism. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is remotely exploitable over the network but requires high attack complexity and no privileges or user interaction. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation of this vulnerability could lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing unauthorized inclusion of local files. This may enable attackers to execute arbitrary code or access sensitive data. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and carefully review file inclusion mechanisms to prevent exploitation. Avoid exposing the vulnerable application to untrusted networks if possible.