This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the PHP-based Select-Themes Getaway product. It allows an unauthenticated attacker to perform local file inclusion, potentially leading to remote code execution. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The affected versions are all versions prior to 1.8, although the exact affected versions were not explicitly stated in the input data. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can result in remote code execution by including arbitrary local files, leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is exploitable without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.