The vulnerability CVE-2026-27989 in ThemeREX Quanzo (versions up to 1.0.10) is caused by improper control of the filename parameter used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially leading to unauthorized file access or code execution. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official fix details are currently available, and no exploits have been observed in the wild. The vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the affected server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall (WAF) rules to detect and block suspicious include/require requests related to this vulnerability.