The vulnerability CVE-2026-39544 in themeStek LabtechCO arises from improper control of filenames in PHP include/require statements, resulting in a Local File Inclusion (LFI) flaw. This issue affects LabtechCO versions up to 8.3. The vulnerability allows an attacker to manipulate file inclusion paths, potentially leading to unauthorized file access within the server environment. There is no CVSS score or vendor advisory indicating patch availability or remediation status at this time.

The impact of this vulnerability is the potential for an attacker to include local files on the server via the vulnerable PHP include/require mechanism. This can lead to unauthorized disclosure of sensitive information or facilitate further attacks depending on the files included. No known exploits have been reported, and the exact impact depends on the server configuration and accessible files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect file inclusion attempts, and reviewing server configurations to limit file inclusion risks.