Emlog CVE-2026-34787

CVSS 6.5 reflects a medium-to-high base severity, driven by a network-accessible attack vector, high confidentiality and integrity impact, and low attack complexity. However, the CVSS vector (PR:H) requires high privileges-typically an administrator or authenticated user with elevated access-which significantly narrows the real-world threat surface. The CVSS metric does not account for the additional CSRF bypass requirement stated in the description; circumventing CSRF protection adds another barrier. This is not a critical vulnerability despite involving code execution, because exploitation requires both high authentication privileges and CSRF token manipulation. Organizations with strict admin access controls and robust CSRF defenses face lower immediate risk. However, any compromise of a high-privilege account (via phishing, credential theft, or lateral movement) would enable trivial file inclusion attacks. SSVC analysis: exploitation is possible (no patch available, local/internal attackers could test bypasses), but automatable exploitation requires either a working CSRF bypass or social engineering of an admin to visit a malicious link. Technical impact is high (code execution), but scope is limited to authenticated high-privilege contexts. This is a high-priority issue for environments with loose access controls or shared admin credentials, but lower-priority for organizations with strong admin access governance.

An attacker with high-privilege admin credentials (obtained via phishing, credential stuffing, or insider access) logs into the Emlog admin panel. The attacker then crafts a malicious GET request to admin/plugin.php with a crafted $plugin parameter pointing to a file writable by the web server (e.g., /tmp/shell.php or a uploads directory where the attacker has previously stored PHP code) or a standard system file containing interpreter directives. If the CSRF token check can be bypassed-either through misconfiguration, token reuse, or social engineering-the require_once statement executes the attacker-supplied file, achieving code execution. Alternatively, if the admin visits a specially crafted link from a compromised website or phishing email (while logged in), a CSRF attack could trigger the malicious include without explicit admin action, provided the CSRF protection is weak.