Emlog up to 2.6.2 admin/plugin.php require_once plugin php file inclusion

Summaryinfo

A vulnerability classified as problematic was found in Emlog up to 2.6.2. Impacted is the function require_once of the file admin/plugin.php. Such manipulation of the argument plugin leads to php file inclusion. This vulnerability is referenced as CVE-2026-34787. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Emlog up to 2.6.2. Affected by this issue is the function require_once of the file admin/plugin.php. The manipulation of the argument plugin with an unknown input leads to a php file inclusion vulnerability. Using CWE to declare the problem leads to CWE-98. The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-34787 since 03/30/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/04/2026).

By approaching the search of inurl:admin/plugin.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Emlog

Version

• 2.6.0
• 2.6.1
• 2.6.2

Website

• Product: https://github.com/emlog/emlog/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion