The vulnerability CVE-2026-22476 in Elated-Themes Etchy arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), where local files on the server can be included and executed by the PHP interpreter. The issue affects Etchy versions up to and including 1.0. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details.

Successful exploitation could allow an unauthenticated remote attacker to include and execute arbitrary local files on the affected server. This can lead to full compromise of the system's confidentiality, integrity, and availability. The high CVSS score (8.1) reflects the critical nature of the impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to the affected application to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.