The vulnerability CVE-2026-28091 affects ThemeREX Coleo versions up to 1.1.7 and is caused by improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. This may allow attackers to execute arbitrary code, access sensitive files, or disrupt service. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX communications for updates. Until a fix is available, restricting access to the affected application and limiting exposure to untrusted networks may reduce risk.