The vulnerability identified as CVE-2026-39613 affects the Boutique product by kutethemes, versions up to 2.3.3. It involves improper control over the filename parameter used in PHP include or require statements, resulting in a PHP Local File Inclusion issue. This can allow an attacker to include and potentially execute files from the local filesystem, leading to unauthorized information disclosure or other impacts depending on the included files. There is no CVSS score or detailed vendor advisory available, and no patch or remediation level has been published yet.

The impact of this vulnerability is the potential for local file inclusion via PHP include/require statements, which may allow attackers to read sensitive files or execute arbitrary code depending on the context. However, no known exploits are reported, and the exact impact depends on the environment and configuration of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to affected versions and applying general PHP security best practices relevant to file inclusion vulnerabilities.