This vulnerability, classified as CWE-98, involves improper control of filenames used in PHP include or require statements in Elated-Themes Måne software. It allows an unauthenticated attacker to perform local file inclusion (LFI) on versions up to 1.7, potentially enabling execution of arbitrary code, data disclosure, and denial of service. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. No official patch or remediation level has been disclosed yet, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated remote attacker to include and execute arbitrary local files on the server running Måne up to version 1.7, leading to full system compromise including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable endpoints and monitor for suspicious activity related to file inclusion attempts.