This vulnerability (CVE-2026-22370) affects the Marveland product by axiomthemes and is characterized by improper control over the filename parameter used in PHP include or require statements. This flaw allows local file inclusion, which can enable attackers to execute arbitrary code or access sensitive files on the server. The CVSS v3.1 score is 8.1, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction. The affected versions include all versions up to 1.3.0. There is no vendor advisory or patch information available, and it is not a cloud service.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing attackers to include and execute arbitrary local files. This can result in unauthorized code execution, data disclosure, or denial of service. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor official channels for updates regarding patches or workarounds.