This vulnerability, classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), affects CartFlows versions up to 3.2.0. It enables remote code execution by exploiting improper validation of filenames in PHP include or require statements. An attacker with contributor-level access can leverage this flaw to execute arbitrary code remotely. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation results in remote code execution with high impact on confidentiality, integrity, and availability. An attacker can execute arbitrary code on the server, potentially leading to full system compromise. The vulnerability requires only contributor-level privileges, which lowers the attacker's initial access requirements.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access and monitor for suspicious activity related to file inclusion. Avoid exposing vulnerable versions in production environments.