The vulnerability CVE-2026-22368 in axiomthemes Redy arises from improper control of the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion issue. This affects Redy versions up to 1.0.2. The CVSS 3.1 score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially exposing sensitive information, executing arbitrary code, or causing denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions and applying general PHP hardening measures relevant to file inclusion vulnerabilities. Monitor vendor channels for updates or patches addressing this issue.