This vulnerability in Mikado-Themes Dolcino arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. Affected versions include Dolcino up to and including 1.6. The CVSS 3.1 base score is 8.1, reflecting network attack vector with high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score indicates a serious risk to confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and review application configurations to limit file inclusion risks. Monitor official Mikado-Themes communications for updates on patches or mitigations.