The vulnerability CVE-2026-22401 affects pavothemes Freshio versions up to 2.4.2. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges and no user interaction to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or access sensitive files via local file inclusion. This poses a high risk to systems running vulnerable versions of Freshio.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting access to vulnerable installations and applying any recommended vendor mitigations once announced.