This vulnerability, identified as CVE-2026-28570, affects SpabRice Vavo Core versions up to and including 2.3.0. It is caused by improper control of filenames in PHP include/require statements, enabling unauthenticated local file inclusion (LFI). The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack vector is network-based with high attack complexity and no privileges or user interaction required. No known exploits are reported in the wild, and no official remediation or patch has been documented.

Successful exploitation allows an attacker to include local files on the server without authentication, potentially leading to disclosure of sensitive information, code execution, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious file inclusion attempts.