The vulnerability CVE-2026-28066 in ThemeREX Legrand arises from improper control of the filename parameter in PHP include/require statements, enabling PHP Local File Inclusion. This issue affects Legrand versions up to 2.17. The CVSS score is 8.1 (high), indicating network attack vector, high impact on confidentiality, integrity, and availability, and requires no privileges or user interaction but has high attack complexity. No patch or mitigation details are currently provided.

Successful exploitation can lead to local file inclusion on the server running the vulnerable Legrand product, potentially exposing sensitive files or enabling further attacks that compromise confidentiality, integrity, and availability of the system. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application and monitor for unusual activity. Avoid exposing the affected versions publicly if possible.