This vulnerability (CVE-2026-39558) affects Elated-Themes Malmö PHP program versions <= 2.2. It is classified under CWE-98 for improper control of filenames in include/require statements, resulting in a local file inclusion vulnerability. The issue allows unauthenticated attackers to include arbitrary local files, which can lead to remote code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1, indicating high impact with network attack vector, high complexity, no privileges or user interaction required, and full confidentiality, integrity, and availability impact. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing attackers to include and execute arbitrary local files. This can result in remote code execution, data disclosure, or denial of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable application to untrusted networks. Follow vendor communications for updates on patches or official mitigations.