The vulnerability identified as CVE-2026-28057 involves improper control of the filename parameter in PHP include/require statements within the ThemeREX Mandala product. This weakness allows local file inclusion (LFI), which can be exploited to include and execute unintended files on the server. The affected versions are Mandala up to 2.8. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, and full compromise of the affected system. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from ThemeREX regarding patches or mitigations.