This vulnerability (CVE-2026-34895) affects WebGeniusLab Softlab Core versions before 1.2.11. It is caused by improper control of filenames used in PHP include or require statements, enabling unauthenticated attackers to perform local file inclusion. This can result in remote file inclusion attacks, potentially allowing execution of arbitrary code or disclosure of sensitive information. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is currently documented, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to remote code execution, unauthorized disclosure of sensitive files, and full compromise of the affected system's confidentiality, integrity, and availability. Because the vulnerability is exploitable without authentication and remotely over the network, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor WebGeniusLab advisories for updates. Until a patch is available, restricting access to the affected application and employing web application firewalls to detect and block suspicious include/require requests may help mitigate risk.