The vulnerability CVE-2026-22408 in Mikado-Themes Justicia arises from insufficient validation of filenames used in PHP include or require statements, enabling local file inclusion. This can allow attackers to execute arbitrary code or access sensitive files on the affected system. The issue affects Justicia versions up to and including 1.2. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to remote code execution or disclosure of sensitive information by including unintended files on the server. This compromises the confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is significant, potentially allowing attackers to fully control the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints. Monitor official Mikado-Themes channels for updates and apply patches promptly once available.