Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-46687Emlog Local File Inclusion (LFI)

High 7.7

In plain English

A high-severity security flaw in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= 2.6.13

Weakness: CWE-24, CWE-98 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg x_refsource_CONFIRM