The vulnerability CVE-2026-27381 affects thembay Aora (up to version 1.3.15) and involves improper control of filenames used in PHP include or require statements. This issue allows PHP Local File Inclusion, which can be exploited to include unintended files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor official channels for updates. Avoid exposing the affected application to untrusted networks or users.