CVE-2026-66450 is an unauthenticated local file inclusion vulnerability in Geo Mashup versions <= 1.13.18. The flaw stems from improper control of filenames used in PHP include or require statements (CWE-98), enabling remote attackers to include arbitrary files on the server. The vulnerability has a CVSS 3.1 score of 8.1, indicating high impact with network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability can lead to remote code execution or disclosure of sensitive files on the server running the vulnerable Geo Mashup plugin. The attacker does not require authentication and can remotely include arbitrary files, potentially compromising the entire system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Geo Mashup plugin versions (<= 1.13.18) or applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates.