The vulnerability CVE-2026-28086 in ThemeREX Run Gran arises from improper validation or control of filenames used in PHP include or require statements. This results in a Local File Inclusion vulnerability, enabling an attacker to include local files on the server. The affected versions are from initial releases through 2.0. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on the affected system. Since it is a Local File Inclusion vulnerability, an attacker could potentially execute arbitrary code or access sensitive files on the server hosting the Run Gran application. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application, applying web application firewalls to detect and block suspicious requests, and reviewing server configurations to limit file inclusion risks. Avoid exposing the application to untrusted networks if possible.