This vulnerability in ThemeREX Coleo arises from insufficient validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. It affects Coleo versions up to and including 1.1.7. The issue could allow an unauthenticated remote attacker to include local files, potentially resulting in arbitrary code execution or information disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system running the vulnerable Coleo version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable functionality and monitor for any suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.