CVE-2026-57788 describes a vulnerability in Edge-Themes Aalto where improper control of the filename used in PHP include or require statements leads to a Local File Inclusion (LFI) issue. This flaw allows an attacker with low privileges and no user interaction to execute arbitrary code or access sensitive files by including local files. The vulnerability affects Aalto versions up to and including 1.8. The CVSS v3.1 base score is 7.5, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files by including local files through the vulnerable PHP include/require statements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application, applying web application firewall rules to block suspicious include requests, and reviewing the application's code to implement proper input validation and sanitization on filenames used in include/require statements.