The vulnerability CVE-2026-28034 in ThemeREX Progress arises from improper validation of filenames used in PHP include or require statements. This improper control enables an attacker to perform Local File Inclusion (LFI), which can lead to execution of arbitrary code or disclosure of sensitive information. The issue affects Progress versions up to 1.2. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The impact affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting access to the vulnerable application and limiting exposure to untrusted networks may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.