The vulnerability CVE-2026-27343 affects VanKarWai Airtifact (<= 1.2.91) and arises from improper control of filenames in PHP include/require statements. This PHP Local File Inclusion vulnerability allows an attacker with low privileges to include unintended local files, potentially leading to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability can lead to full compromise of the affected system by allowing attackers to execute arbitrary code or access sensitive files. The high CVSS score (7.5) indicates critical impacts on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor VanKarWai's advisories for updates. In the meantime, restricting access to vulnerable versions and applying best practices to limit exposure of the affected application is advisable.