The vulnerability CVE-2026-28065 affects ThemeREX Eject versions up to 2.17 and is caused by improper control over the filename parameter used in PHP include or require statements. This flaw allows local file inclusion, potentially enabling an attacker to execute arbitrary local files on the server. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, modification of data, and disruption of service on the affected system. The high CVSS score indicates significant risk if exploited. However, no known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable systems and review PHP include/require usage in the affected product to mitigate potential exploitation.