CVE-2026-46687: Emlog Local File Inclusion (LFI)
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46687?
CVE-2026-46687 has a risk rating of 50.
How do I fix CVE-2026-46687?
To fix CVE-2026-46687, upgrade to Emlog version 2.6.14 or later, which addresses the local file inclusion vulnerability.
What does CVE-2026-46687 affect?
CVE-2026-46687 affects the Emlog open source website building system, specifically versions 2.6.13 and earlier.
What kind of vulnerability is CVE-2026-46687?
CVE-2026-46687 is a local file inclusion (LFI) vulnerability that allows unauthorized file access.
What are the potential consequences of CVE-2026-46687?
Exploitation of CVE-2026-46687 can lead to exposure of sensitive files on the server, potentially compromising the security of the website.