CVE-2026-52707 is an unauthenticated local file inclusion vulnerability in Mikado-Themes Kastell software versions <= 2.0. The vulnerability is caused by improper validation of file path input, allowing path traversal sequences ('.../...//') to include arbitrary local files. This can be exploited remotely without authentication, resulting in high impact on confidentiality, integrity, and availability as indicated by a CVSS 3.1 score of 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to include and potentially execute arbitrary local files on the affected system. This can lead to full compromise of confidentiality, integrity, and availability of the Kastell installation and underlying system. The high CVSS score reflects the critical nature of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable Kastell instances and monitor for unusual activity. No vendor-provided temporary fixes or mitigations are currently documented.