Which versions of Emlog are affected by EUVD-2026-44986?

Emlog versions 2.6.13 and earlier are vulnerable to local file inclusion that enables code execution through malicious template inputs by authenticated authors.

How to fix or mitigate EUVD-2026-44986?

Within 24 hours: Inventory all Emlog installations and identify instances running version 2.6.13 or earlier through asset management systems or web scanning tools. Audit author-level user accounts and disable or revoke unnecessary access for non-administrative personnel. Review recent template modifications in application logs for suspicious path-traversal patterns. Within 7 days: Implement input validation controls on template path parameters using a Web Application Firewall (WAF) or application-level filtering to block directory traversal sequences. Deploy file integrity monitoring on web-accessible PHP directories to detect unauthorized file creation or modification. Within 30 days: Contact the Emlog project for patch availability and timeline; if no patch is forthcoming within 90 days, evaluate migration to alternative content management platforms with active security support. Establish code-level patches or vendor-supported workarounds if available.

Emlog EUVD-2026-44986

Q: What is the CVSS score of EUVD-2026-44986?

EUVD-2026-44986 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-46687 HIGH

Path Traversal: '../filedir' (CWE-24)

2026-07-16 GitHub_M

PHP Information Disclosure Emlog

7.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Author account gives PR:L; needing an includable local .php file is an attack requirement modeled as AC:H; successful inclusion yields full host code execution, so C/I/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 17:46 vuln.today

CVE Published

Jul 16, 2026 - 17:01 cve.org

HIGH 7.7

DescriptionCVE.org

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

AnalysisAI

Local file inclusion in Emlog 2.6.13 and earlier lets an authenticated author supply a path-traversal template value that is stored unvalidated by api_controller.php and later passed to View::getView() in log_controller.php, causing an arbitrary local .php file to be included when the article is viewed. Because included PHP is executed, an attacker who can place or influence a .php file on the host can escalate this to code execution. No public exploit has been identified at time of analysis, and no fixed version currently exists.

Technical ContextAI

Emlog is an open-source PHP blogging/website-building CMS (CPE cpe:2.3:a:emlog:emlog). The flaw is a CWE-24 path traversal ('../filedir') in the article-publishing workflow: api_controller.php persists a template parameter supplied during publishing without stripping directory-traversal sequences, and log_controller.php later performs a file_exists() check and then include()s the path via View::getView($template). Because PHP include() executes any included file as code, a traversal string that resolves to an attacker-influenced .php file turns a file-inclusion primitive into potential code execution. The root cause is trusting a client-supplied path in a filesystem include sink without allow-listing to the intended template directory.

RemediationAI

No vendor-released patch identified at time of analysis and no fixed version is named, so upgrade is not yet possible; monitor advisory GHSA-9h6g-q584-9vfg (https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg) for a patched release. As compensating controls: restrict the author role to trusted users only and audit existing author accounts, since exploitation requires authenticated author access (this reduces publishing flexibility for lower-trust contributors); deploy a WAF or input filter that rejects template parameters containing traversal sequences ('../', encoded variants, absolute paths) on the article-publishing endpoint (may break legitimately named templates); enforce a strict PHP open_basedir to block inclusion outside the template directory and neutralize traversal at the runtime level (can break plugins relying on broad file access); and remove or restrict write access to directories where an author could stage a .php file, limiting escalation to code execution.