The RadiusTheme Metro product suffers from a PHP Local File Inclusion vulnerability due to improper control of filenames in include/require statements. This flaw allows an attacker to manipulate the filename parameter to include unintended local files, which can lead to remote code execution or disclosure of sensitive information. The vulnerability affects versions up to 2.13. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to an attacker executing arbitrary code on the affected system by including local files. This compromises the confidentiality, integrity, and availability of the system, potentially allowing full system compromise or data leakage. No known exploits have been reported in the wild, but the high CVSS score reflects the serious impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block attempts to exploit file inclusion. Avoid exposing the affected application to untrusted networks if possible.