The vulnerability CVE-2026-32426 affects themelexus Medilazar Core before version 1.4.7. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with limited privileges to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The CVSS score is 7.5 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity. No official patch or vendor advisory is currently referenced.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files, potentially executing arbitrary code or accessing sensitive information. The vulnerability requires network access and low privileges but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable component to untrusted networks if possible.