ThemetechMount Boldman up to version 7.7 suffers from an improper control of filename for include/require statements in PHP, resulting in a Local File Inclusion vulnerability. This allows an attacker to include unintended files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, low privileges required, and high attack complexity.

Successful exploitation could lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires network access and low privileges but has high attack complexity, limiting ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and review PHP include/require usage to ensure proper input validation. Monitor for vendor updates regarding patches or official mitigations.