The vulnerability CVE-2026-27343 affects VanKarWai Airtifact software up to version 1.2.91. It is caused by improper control of the filename parameter used in PHP include or require statements, resulting in a PHP Local File Inclusion vulnerability. This flaw allows an attacker with low privileges to potentially execute arbitrary code or access sensitive files, impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.5, reflecting a high severity with network attack vector, high complexity, low privileges required, no user interaction, and unchanged scope.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service in the affected Airtifact application. The attacker requires low privileges but must overcome high attack complexity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Users should monitor VanKarWai's advisories for updates and apply any official fixes once available. Until then, restricting access to vulnerable components and minimizing privileges may reduce risk.