The vulnerability CVE-2026-22362 in axiomthemes Photolia arises from improper validation or control of filenames used in PHP include or require statements. This improper control enables PHP Local File Inclusion, allowing attackers to potentially execute arbitrary local files on the affected system. The issue affects Photolia versions up to and including 1.0.3. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service on the affected system. Because it is a local file inclusion issue, attackers might execute arbitrary code or access sensitive files on the server hosting Photolia. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected application and limiting exposure to untrusted users may reduce risk.