CMSMasters Content Composer versions up to 1.4.5 suffer from a PHP Local File Inclusion vulnerability due to improper validation of filenames used in include/require statements. This can allow an attacker with low privileges and no user interaction to execute arbitrary code or access sensitive files on the affected system. The vulnerability is network exploitable but requires high attack complexity. It impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.5.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and denial of service. The vulnerability affects all installations of CMSMasters Content Composer up to version 1.4.5. No evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable component to untrusted networks.