CVE-2026-28150 is an unauthenticated local file inclusion vulnerability in the uxper Golo Framework before version 1.7.5. It stems from improper control of filenames in PHP include/require statements (CWE-98), enabling attackers to include arbitrary files. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at a high level as indicated by the CVSS score of 8.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates.