The vulnerability CVE-2026-28119 in axiomthemes Nirvana (up to version 2.6) arises from improper control of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This flaw allows an attacker to include local files on the server, which can lead to execution of arbitrary code or disclosure of sensitive information. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. Attackers may execute arbitrary code or access sensitive files on the server. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected application and limiting exposure to untrusted networks may reduce risk.