This vulnerability in CreativeWS Kiddy arises from improper validation or control over filenames used in PHP include or require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full system compromise. The CVSS score of 8.1 reflects the high impact on confidentiality, integrity, and availability, with network attack vector but high complexity and no privileges required. The affected versions include all up to and including 2.0.8. No known exploits in the wild have been reported, and no patch or vendor advisory information is currently available.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files on the server running CreativeWS Kiddy versions up to 2.0.8. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected application and implementing web application firewall rules to detect and block suspicious include/require requests targeting local files.