The vulnerability CVE-2026-39613 affects the Boutique product by kutethemes, specifically versions up to and including 2.3.3. It arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges and no user interaction to execute arbitrary code or access sensitive files on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing attackers to read sensitive files, execute arbitrary code, and disrupt service. The impact is rated high due to the potential for full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall rules to detect and block suspicious include/require requests, and limiting privileges of the web server process to reduce potential impact.