The vulnerability identified as CVE-2026-28086 affects the ThemeREX Run Gran product through improper control of filenames in PHP include or require statements. This results in a PHP Local File Inclusion vulnerability, allowing an attacker to include local files on the server. The issue impacts versions up to 2.0 of Run Gran. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No official patch or vendor advisory is provided at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files on the server running the vulnerable Run Gran product, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and carefully monitor for any suspicious activity. Avoid exposing the vulnerable application to untrusted networks where possible.