The vulnerability CVE-2026-32426 affects themelexus Medilazar Core before version 1.4.7. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with limited privileges to include arbitrary files from the local filesystem, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, and low privileges required.

Successful exploitation of this vulnerability could lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files on the server, potentially executing arbitrary code or accessing sensitive data. The vulnerability requires network access and low privileges but has high attack complexity. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor themelexus advisories for updates. Until a fix is available, restricting access to vulnerable endpoints and applying strict input validation on filenames used in include/require statements may reduce risk.