CVE-2026-62074: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in ThemeREX Ozeum

This vulnerability, identified as CVE-2026-62074, affects ThemeREX Ozeum versions <= 1.3.0. It is a Local File Inclusion (LFI) issue caused by improper control of filenames used in PHP include or require statements. The flaw allows unauthenticated attackers to include arbitrary files on the server, which can lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in complete compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected application and monitor for unusual activity related to file inclusion attempts.