PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39611 kutethemes CVE debrief

CVE-2026-39611 is a HIGH severity vulnerability with a CVSS score of 7.5, affecting kutethemes KuteShop kuteshop from n/a through <= 4.2.9. This issue relates to Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). The vulnerability allows attackers to include local files via crafted requests, potentially leading to code execution. Users of KuteShop version 4.2.9 or earlier should apply patches or mitigations to prevent potential PHP Local File Inclusion attacks. The CVE record was published on 2026-04-08T09:16:30.580Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. To address this vulnerability, it is essential to understand the nature of PHP Local File Inclusion and its potential impact on the affected systems.

Vendor
kutethemes
Product
KuteShop
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of kutethemes KuteShop kuteshop version 4.2.9 or earlier should apply patches or mitigations to prevent potential PHP Local File Inclusion attacks.

Technical summary

CVE-2026-39611 is a PHP Local File Inclusion vulnerability in kutethemes KuteShop kuteshop. The vulnerability arises from improper control of filenames for include/require statements in PHP programs. This issue has a CVSS score of 7.5 and is classified as HIGH severity. The affected versions of KuteShop range from n/a through <= 4.2.9.

Defensive priority

High priority should be given to patching or mitigating this vulnerability in KuteShop installations, as it could allow attackers to include local files via crafted requests.

Recommended defensive actions

  • Apply the latest patches or updates for KuteShop to version 4.2.9 or later.
  • Implement input validation and sanitization for filenames used in include/require statements.
  • Use secure protocols for including files, such as using absolute paths or whitelisting allowed files.
  • Monitor for suspicious requests that could indicate exploitation attempts.
  • Consider using a Web Application Firewall (WAF) to detect and block malicious requests.

Evidence notes

The CVE record was published on 2026-04-08T09:16:30.580Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Patchstack has provided a mitigation reference for this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39611 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39611

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39611 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39611

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.