This vulnerability is a Local File Inclusion (LFI) issue in the NFSen module of LibreNMS (file nfsen.inc.php). Authenticated users can manipulate the 'nfsen' parameter to perform path traversal and include arbitrary PHP files from the server filesystem. This can lead to unauthorized file inclusion, potentially exposing sensitive information or enabling further attacks. The vulnerability is identified as CWE-98 and has a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation is currently documented.

The vulnerability allows authenticated attackers to include arbitrary PHP files from the server filesystem, which can lead to disclosure of sensitive information (high confidentiality impact). There is no reported impact on integrity or availability. Since the attacker must be authenticated, the risk is limited to users with some level of access. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected module to trusted users only and monitor for suspicious activity related to the 'nfsen' parameter. Avoid exposing the vulnerable module to untrusted networks. Follow vendor channels for updates on patches or official mitigations.