The vulnerability CVE-2026-28010 affects ThemeREX Scientia versions up to 1.2.4 and is caused by improper control of filenames in PHP include/require statements, leading to PHP Local File Inclusion. This can allow attackers to include unintended files, potentially resulting in remote code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive information, or disrupt service. The high CVSS score indicates severe impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or restrict access to vulnerable components. Monitor ThemeREX advisories for updates and apply patches promptly once available.