The vulnerability in Turbo Manager is an improper control of the filename used in PHP include/require statements, allowing an attacker to trigger Local File Inclusion. When an attacker can supply a crafted file path, the application can include local files, potentially enabling execution of arbitrary PHP code and remote code execution. This weakness is identified as CWE-98.

The affected product is the Turbo Manager plugin from redqteam. All releases from the initial version up to, but not including, 4.0.8 are impacted. The exact range of affected versions is specified as "n/a through < 4.0.8".

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that current exploitation activity is low. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves a web request to the vulnerable plugin’s endpoint that allows a file path parameter; based on the description it is inferred that an attacker can manipulate this parameter to cause the include operation to load arbitrary local files.