This vulnerability involves improper control of the filename parameter in PHP include or require statements within the Select-Themes Tonda product. It allows an attacker with low privileges and no user interaction to perform local file inclusion, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity.

Successful exploitation can lead to full compromise of the affected system by allowing an attacker to include and execute arbitrary local files. This impacts confidentiality, integrity, and availability of the system. The vulnerability requires low privileges but has high attack complexity and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates.