The vulnerability CVE-2026-28095 in ThemeREX Marcell arises from improper validation of filenames used in PHP include or require statements, leading to a Local File Inclusion (LFI) issue. This can allow an attacker to include arbitrary local files, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system. The issue affects versions up to 1.2.14. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or disclose sensitive information by including local files on the server running the vulnerable ThemeREX Marcell software. This impacts confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor ThemeREX communications for updates. Until a fix is available, consider restricting access to the vulnerable application and applying web application firewall rules to detect and block suspicious include/require requests.