CVE-2026-46687: Emlog Local File Inclusion (LFI)

Severity: high (CVSS 7.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-16 · updated 2026-07-17
Weakness: CWE-24

Description

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

Affected products

emlog: through 2.6.13

References

https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg
https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg

Get alerted when CVE-2026-46687 or the next vulnerability affects your stack