This vulnerability in Mikado-Themes Aviana arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). The affected versions include all releases up to and including 2.1. The issue allows an unauthenticated remote attacker to cause the application to include local files, which can lead to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. Attackers may read sensitive files or execute arbitrary code, severely impacting the security posture of systems running vulnerable versions of Aviana.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from Mikado-Themes.