Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-34787Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter

Medium 6.5

In plain English

A medium-severity security flaw in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 54.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= 2.6.2

Weakness: CWE-98 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-7mvq-qj5x-5phm x_refsource_CONFIRM