The vulnerability CVE-2026-28018 in ThemeREX Global Logistics (<= 3.20) is caused by improper control of the filename parameter in PHP include/require statements, resulting in a Local File Inclusion (LFI) vulnerability. This allows an attacker to include and execute local files on the server, which can lead to complete system compromise. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on the affected system. The attacker can potentially execute arbitrary code by including local files, severely impacting system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting access to vulnerable endpoints and applying general PHP security best practices relevant to file inclusion vulnerabilities.