The vulnerability CVE-2026-39677 in Creatives_Planet Emphires (versions up to 3.9) arises from improper control of the filename parameter in PHP include/require statements, resulting in a PHP Local File Inclusion (LFI) vulnerability. This allows an attacker to include and potentially execute or disclose local files on the affected system. The vulnerability is confirmed published but lacks a CVSS score, vendor advisory, or patch information. It is not a cloud service vulnerability and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server or execute arbitrary code depending on the context of the included files. This can lead to information disclosure, privilege escalation, or further compromise of the affected system. However, no known exploits are reported, and the exact impact depends on the server configuration and application usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the vulnerable application, implement input validation or filtering on filename parameters if possible, and monitor for unusual activity related to file inclusion attempts.