CVE-2026-28048 is a vulnerability in magentech FlashMart (versions ≤ 2.0.15) caused by improper control of filenames in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, allowing attackers to include local files on the server. The vulnerability has a high CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector with high impact on confidentiality, integrity, and availability, but requiring high attack complexity and no privileges or user interaction. No patch or vendor advisory is provided, and no known exploits are reported.

Successful exploitation of this vulnerability could allow an attacker to read or execute local files on the affected server, potentially leading to full compromise of the system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is severe if exploited. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests if possible.