The vulnerability CVE-2026-27987 affects ThemeREX The Qlean up to version 2.12 and is characterized by improper control of the filename used in PHP include/require statements. This leads to a Local File Inclusion (LFI) vulnerability, where an attacker can trick the application into including unintended files from the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The vulnerability is published and tracked but lacks vendor-provided patch or mitigation details at this time.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. The high CVSS score (8.1) confirms the severity of these impacts. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to vulnerable installations, apply strict input validation if possible, and monitor for suspicious activity related to file inclusion attempts. Avoid exposing vulnerable versions to untrusted networks.