What is the CVSS score of CVE-2026-34787?

CVE-2026-34787 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-34787

MEDIUM

PHP Remote File Inclusion (CWE-98)

2026-04-03 GitHub_M

LFI CSRF PHP RCE

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 03, 2026 - 23:15 vuln.today

CVE Published

Apr 03, 2026 - 22:36 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.

AnalysisAI

Local file inclusion in Emlog admin/plugin.php allows authenticated attackers to execute arbitrary PHP code via unsanitized $plugin parameter in GET requests, provided CSRF token validation can be bypassed. Emlog versions 2.6.2 and prior are affected. An authenticated attacker with high privileges can include arbitrary files from the server filesystem, achieving remote code execution without requiring user interaction. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Emlog is an open-source PHP-based website building system. The vulnerability exists in the admin/plugin.php file at line 80, where the $plugin parameter from a GET request is directly passed to a require_once statement without input validation or sanitization. This is a classic Local File Inclusion (CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program) vulnerability. The root cause is insufficient filtering of user-controlled input before its use in a filesystem include operation. An attacker exploiting this would need to bypass the CSRF token check (which typically validates a session-specific token) to craft a malicious request that includes a file path like '../../../etc/passwd' or a user-writable path containing attacker-controlled PHP code. Once a suitable file is included via require_once, PHP code execution occurs with the privileges of the web server process.

RemediationAI

No vendor-released patch has been identified at time of analysis; contact the Emlog project directly via the GitHub Security Advisory (https://github.com/emlog/emlog/security/advisories/GHSA-7mvq-qj5x-5phm) for patch availability and expected timeline. As an immediate workaround, restrict access to the admin panel to trusted IP addresses via firewall or web server configuration (.htaccess or nginx rules), enforce strong, unique administrator credentials, and monitor admin/plugin.php access logs for suspicious activity. Additionally, implement or strengthen CSRF token validation in the admin interface to ensure that even compromised sessions cannot be leveraged by cross-site attacks. Review the $plugin parameter handling in admin/plugin.php (line 80) and apply input validation such as whitelisting allowed plugin names or using basename() to strip directory traversal sequences. Until an official patch is available, consider temporarily disabling the plugin management interface if not actively used.