The vulnerability CVE-2026-22371 affects the AncoraThemes Gustavo product up to version 1.2.2. It arises from improper validation or control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to read or execute arbitrary files on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector with high impact but requiring high attack complexity and no privileges or user interaction. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing attackers to disclose sensitive information, execute arbitrary code, or disrupt service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, but the vulnerability poses a serious risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and applying any available workarounds from the vendor. Monitor official AncoraThemes communications for updates on patches or mitigations.