CVE-2026-34787
Local File Inclusion in Emlog admin/plugin.php Enables Code Execution
Publication date: 2026-04-03
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| emlog | emlog | to 2.6.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to execute arbitrary PHP code on the affected server by including files from the server's filesystem. This can lead to unauthorized control over the website or server, potentially compromising sensitive data, defacing the website, or using the server as a launch point for further attacks.
Can you explain this vulnerability to me?
This vulnerability exists in Emlog, an open source website building system, specifically in versions 2.6.2 and earlier. It is a Local File Inclusion (LFI) vulnerability found in the admin/plugin.php file at line 80. The issue arises because the $plugin parameter from a GET request is used directly in a require_once statement without proper sanitization. If an attacker can bypass the CSRF token check, they can include arbitrary PHP files from the server's filesystem, which can lead to remote code execution.
What immediate steps should I take to mitigate this vulnerability?
Since there are no publicly available patches at the time of publication, immediate mitigation steps include restricting access to the vulnerable admin/plugin.php page, especially limiting access to trusted administrators only.
Additionally, monitor and block suspicious GET requests that include the $plugin parameter to prevent exploitation attempts.
Implement additional security controls such as Web Application Firewalls (WAF) to detect and block attempts to exploit Local File Inclusion vulnerabilities.
Finally, keep an eye on official sources for any future patches or updates addressing this vulnerability.