The vulnerability CVE-2026-39544 affects themeStek's LabtechCO product through improper control of filenames in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw allows an attacker to include unintended files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. The affected versions include all up to 8.3. No vendor-provided patch or official remediation level is currently documented.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, and potential denial of service. The attacker requires only low privileges and no user interaction, making it a significant risk. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks where possible.