The vulnerability CVE-2026-22368 affects axiomthemes Redy versions up to 1.0.2. It arises from improper control of the filename parameter in PHP include/require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in an attacker reading sensitive files, executing arbitrary code, and causing denial of service on the affected system. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. No known exploits have been reported, but the vulnerability poses a serious risk if leveraged.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include parameters may help reduce risk.