This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within Mikado-Themes Cortex, allowing an attacker to perform Local File Inclusion (LFI). This can enable an attacker to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The issue affects Cortex versions up to and including 1.9. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files on the server running the vulnerable Cortex version. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor Mikado-Themes communications for updates. Until a fix is available, avoid exposing vulnerable Cortex installations to untrusted networks and consider applying temporary mitigations such as restricting file inclusion paths if possible.