The vulnerability CVE-2026-27334 in dan_fisher Alchemists (<= 4.6.0) arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw can be exploited remotely over the network without privileges or user interaction, but requires high attack complexity. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.1, reflecting high impact and network attack vector with no privileges required.

An attacker can exploit this vulnerability to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the affected application and applying general PHP security best practices may reduce risk.