This vulnerability in KuteShop arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion (LFI). An attacker with low privileges can exploit this to include unintended files, which may lead to arbitrary code execution or disclosure of sensitive information. The issue affects all versions up to and including 4.2.9. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to read sensitive files or execute arbitrary code within the context of the web server, potentially compromising the confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is significant. However, no known exploits have been reported in the wild so far.

No official patch or remediation guidance has been provided by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to vulnerable endpoints and applying general PHP hardening measures relevant to file inclusion vulnerabilities.