The vulnerability CVE-2026-32500 affects CreativeWS MetaMax versions up to 1.1.4. It arises from improper control over the filename parameter used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to execute arbitrary local files within the context of the web server, potentially compromising system confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on all security properties.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system. This may result in unauthorized data access, code execution, or denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and validate or sanitize all input parameters controlling file inclusion. Avoid exposing the application to untrusted inputs that influence file paths.