Threats affecting pkg:composer/elated-themes/malmo

CVE-2026-39558 is a high severity vulnerability in Elated-Themes Malmö versions up to and including 2.2. It is an unauthenticated local file inclusion (LFI) issue caused by improper control of filenames used in include or require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.