The vulnerability identified as CVE-2026-27987 affects ThemeREX The Qlean versions up to 2.12. It involves improper control over the filename parameter in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This can allow attackers to include unintended local files, potentially leading to remote code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction for exploitation. No patch or vendor advisory details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running ThemeREX The Qlean. This may result in unauthorized data access, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application, apply web application firewall rules to detect and block suspicious include requests, and avoid running the application with excessive privileges.