The vulnerability CVE-2026-24538 in omnipressteam Omnipress arises from improper validation or control of filenames used in PHP include or require statements. This results in a PHP Local File Inclusion issue, potentially allowing an attacker with low privileges to include unintended files, which can compromise confidentiality, integrity, and availability of the system. The affected versions are up to and including 1.6.7. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service within the affected Omnipress installations. The attacker requires only low privileges and no user interaction, but must overcome high attack complexity. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing vulnerable versions to untrusted networks and restrict access to the application to trusted users only. Monitor vendor channels for updates or patches addressing this vulnerability.