CVE-2026-63302 is a Local File Inclusion vulnerability in OpenSolution Quick.CMS affecting the admin.php endpoint through the p parameter. This vulnerability allows an authenticated admin user to include arbitrary files from the application's directory structure by crafting a specific HTTP request. Exploitation results in path disclosure, revealing server directory structures and absolute file paths. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity). The vendor has not provided an official fix and considers the risk of exploitation very low.

Successful exploitation allows an authenticated administrator to disclose the server's directory structure and absolute file paths via Local File Inclusion. This information disclosure could aid further attacks but does not directly allow remote code execution or privilege escalation. The impact is limited to information disclosure within the scope of an authenticated admin user.

The vendor has assessed the likelihood of exploitation as very low and determined that a fix is not necessary. No official patch or remediation is currently provided. Users should ensure that only trusted administrators have access to the admin interface to reduce risk.