CVE-2026-62099: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in kutethemes Boutique

This vulnerability (CVE-2026-62099) is classified under CWE-98, which involves improper control of filenames used in PHP include or require statements. It affects the Boutique product by kutethemes in versions up to 2.3.3. The flaw allows unauthenticated attackers to perform Local File Inclusion, which can lead to remote code execution or disclosure of sensitive files. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service. Because it is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.