The vulnerability identified as CVE-2026-57794 affects the uxper Golo Framework through improper control of the filename parameter in PHP include/require statements. This weakness leads to PHP Local File Inclusion, which can be exploited to include unauthorized files and execute arbitrary code within the context of the web server. The issue impacts all versions of Golo Framework up to and including 1.7.3. The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector network, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, and potentially compromise the affected system's confidentiality, integrity, and availability. The high CVSS score reflects significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as restricting file inclusion paths, disabling remote file inclusion in PHP settings, and limiting web server permissions to reduce the attack surface. Monitor vendor communications for updates on patches or official mitigations.