This vulnerability, identified as CWE-98, arises from improper control of the filename parameter in PHP include or require statements within the Select-Themes Struktur Core product. It allows local file inclusion (LFI), which can lead to arbitrary code execution or information disclosure. The affected versions are Struktur Core up to 2.5.1. The CVSS v3.1 score is 7.5, indicating high severity, with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet.

An attacker with low privileges can exploit this vulnerability remotely to include local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The impact affects confidentiality, integrity, and availability of the affected system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates.