The vulnerability identified as CVE-2026-32364 affects redqteam's Turbo Manager versions before 4.0.8. It is caused by improper validation or control of filenames used in PHP include or require statements, which enables PHP Local File Inclusion. This can allow an attacker with low privileges to include and execute local files on the server, potentially leading to full compromise of the system. The CVSS score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on the affected Turbo Manager installations. The attacker requires only low privileges and no user interaction, but must overcome high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users of Turbo Manager should monitor vendor communications closely and apply updates once available. Until then, restricting access to the application and minimizing privileges may reduce risk.