CVE-2026-34787: Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter
Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a requireonce path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Emlogto a version that resolves this vulnerability.Fixed in 2.6.2 - Configuration
Fix the Local File Inclusion by ensuring the GET $plugin parameter is properly sanitized/validated before it is used in the require_once path in admin/plugin.php (line 80 in versions 2.6.2 and prior).
admin/plugin.php $plugin parameter handling (require_once path) = sanitized/validated - Compensating control
Ensure the CSRF token check cannot be bypassed for requests to admin/plugin.php (the CSRF check bypass would enable LFI via the GET parameter).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34787?
CVE-2026-34787 has been categorized as a high severity Local File Inclusion vulnerability affecting Emlog versions 2.6.2 and prior.
How do I fix CVE-2026-34787?
To fix CVE-2026-34787, you should upgrade Emlog to version 2.6.3 or later where the vulnerability has been patched.
What versions of Emlog are affected by CVE-2026-34787?
CVE-2026-34787 affects Emlog versions up to and including 2.6.2.
What is a Local File Inclusion vulnerability as seen in CVE-2026-34787?
A Local File Inclusion vulnerability allows an attacker to include files from the server's file system, potentially leading to unauthorized access or code execution.
Where can I locate more information regarding CVE-2026-34787?
Additional information about CVE-2026-34787 can typically be found in security advisories and databases that track vulnerabilities.