emlog up to 2.6.13 Article Publishing Interface api_controller.php getView template php file inclusion

Summaryinfo

A vulnerability was found in emlog up to 2.6.13. It has been rated as problematic. Affected by this issue is the function getView of the file api_controller.php of the component Article Publishing Interface. The manipulation of the argument template leads to php file inclusion. This vulnerability is traded as CVE-2026-46687. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in emlog up to 2.6.13 and classified as problematic. This issue affects the function getView of the file api_controller.php of the component Article Publishing Interface. The manipulation of the argument template with an unknown input leads to a php file inclusion vulnerability. Using CWE to declare the problem leads to CWE-98. The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. Impacted is confidentiality. The summary by CVE is:

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-46687 since 05/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

By approaching the search of inurl:api_controller.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-44986). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• emlog

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.6.10
• 2.6.11
• 2.6.12
• 2.6.13

Website

• Product: https://github.com/emlog/emlog/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion