The vulnerability CVE-2026-22395 in Mikado-Themes Fiorello involves improper control of the filename parameter used in PHP include or require statements, resulting in a PHP Local File Inclusion (LFI) vulnerability. This flaw allows an attacker to include local files on the server, potentially leading to disclosure of sensitive information or further compromise. The affected versions are from initial releases through version 1.0. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or mitigation details have been disclosed by the vendor or in the advisory.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server running the vulnerable Fiorello theme, potentially leading to disclosure of sensitive data, code execution, or full system compromise. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable Fiorello theme or restricting access to the affected application to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.