The vulnerability CVE-2026-22395 in Mikado-Themes Fiorello theme arises from improper control over the filename parameter in PHP include/require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary local files on the server, potentially compromising the system. The issue affects Fiorello versions up to 1.0. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a high-severity remote vulnerability with high impact on confidentiality, integrity, and availability. No patch or official fix information is currently provided by the vendor.

Successful exploitation of this vulnerability could allow remote attackers to include and execute arbitrary local files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running the vulnerable Fiorello theme. This may result in unauthorized data access, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable Fiorello theme to prevent exploitation. Monitor Mikado-Themes vendor channels for updates and apply patches promptly once released.