Emlog CVE-2026-46687

Exploitation requires an authenticated account with the author (publishing) role, because the malicious template value is injected via the article-publishing interface in api_controller.php. The primitive only includes LOCAL .php files, so the attacker must reference a .php file that already exists on the server or otherwise get one written to disk - this is the AT:P attack requirement and the main limiting factor for full code execution; absent an includable PHP payload, impact is limited to whatever local .php exists. Triggering also requires the affected article to be viewed so log_controller.php reaches the file_exists()/View::getView() include path. No victim interaction beyond article rendering is needed (UI:N), and the endpoint is network-reachable (AV:N). Limiting factors: valid author credentials (PR:L), presence of an includable local .php file, and running Emlog 2.6.13 or earlier.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.7) describes a network-reachable but privileged and conditional attack: PR:L requires a valid author account, and AT:P signals that specific attack requirements must be met - here, referencing an existing includable local .php file, since the primitive only includes local files. This meaningfully lowers real-world risk versus an unauthenticated RCE. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited; EPSS and SSVC data were not provided. Net: a credible high-impact issue for multi-author Emlog deployments, but exploitation depends on holding author credentials and on the presence of includable PHP, making it targeted rather than mass-exploitable - prioritize where untrusted users hold author roles.

An attacker holding (or registering/phishing) an Emlog author account publishes an article and sets the template parameter to a traversal path such as '../../uploads/evil.php', paired with any avenue that lets them drop a .php file on the host. When the article is viewed, log_controller.php passes the path to View::getView() and include() executes the attacker's PHP, yielding code execution. No public POC has been identified, and the network attack vector is gated by the author-level authentication requirement.