CVE-2026-46687 — Emlog Local File Inclusion (LFI)
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php witho…
Published: 2026-07-16 · CVSS: 7.7 · CVSS 4.0
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7