This vulnerability in ThemeREX OsTende arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion attacks. It affects OsTende versions up to 1.4.3. The issue can be exploited remotely over the network without privileges or user interaction, but requires high attack complexity. Successful exploitation results in high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided.

Exploitation of this vulnerability can lead to local file inclusion, potentially allowing attackers to read sensitive files, execute arbitrary code, or disrupt service, severely impacting confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 reflects these critical impacts. No known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions and applying any recommended temporary mitigations from the vendor. Avoid exposing the affected application to untrusted networks if possible.