This vulnerability in Creatives_Planet Emphires (<= 3.9) arises from improper control over filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) flaw. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. The vulnerability allows an attacker to include local files on the server, potentially leading to sensitive information disclosure or code execution depending on the application context. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could lead to disclosure of sensitive files, modification of application behavior, or denial of service due to inclusion of unintended local files. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions, applying application-level input validation or filtering on include/require parameters, and monitoring for suspicious activity related to file inclusion attempts.