The vulnerability CVE-2026-28009 in ThemeREX DroneX involves improper control of the filename parameter in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This allows an attacker to include and execute files from the local server, which can lead to confidentiality, integrity, and availability impacts. The issue affects DroneX versions up to 1.1.12. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of ThemeREX DroneX should monitor for vendor updates and advisories. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious requests targeting include/require parameters.