The vulnerability CVE-2026-27989 in ThemeREX Quanzo arises from improper validation of filenames used in PHP include/require statements, enabling PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The issue affects Quanzo versions up to 1.0.10. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files by including local files through the vulnerable PHP include/require statements. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor ThemeREX communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable theme or applying manual code review and hardening to prevent local file inclusion.