The vulnerability CVE-2026-32531 in gavias Kunco involves improper control of the filename parameter in PHP include/require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw exists in versions before 1.4.5 and can be exploited remotely over the network without privileges or user interaction, but requires high attack complexity. The vulnerability impacts confidentiality, integrity, and availability, as reflected by the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No patch or official remediation guidance is currently available from the vendor or other sources.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the affected server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score (8.1) indicates significant impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to affected systems, applying web application firewalls with rules to detect and block suspicious include/require parameters, and reviewing application code for unsafe file inclusion practices. Avoid exposing vulnerable versions in public-facing environments.