The vulnerability CVE-2026-57799 in uxper Nuss arises from improper control of filenames used in PHP include or require statements, enabling local file inclusion (LFI). This flaw affects Nuss versions up to 1.3.6. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows an attacker to include local files on the server, potentially leading to disclosure of sensitive information, modification of application behavior, or denial of service. The CVSS score indicates a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying strict input validation on filenames used in include/require statements may reduce risk.