CVE-2026-28152: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Select-Themes Tonda Core

This vulnerability in Tonda Core before version 2.6 is an unauthenticated local file inclusion (LFI) issue caused by improper control of filenames used in PHP include or require statements. The flaw allows remote attackers to include files on the server without authentication, potentially leading to full compromise of the affected system. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on affected Tonda Core installations. The unauthenticated nature of the flaw increases the risk as no credentials are required to exploit it. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable instances and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.