CVE-2026-46687

Summary

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

Affected Software

Weaknesses

• CWE-24: CWE-24: Path Traversal: '../filedir'
• CWE-98: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg

References

• https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg

• ←Previous
• Next→