CVE-2026-46687

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.14

Description The article publishing interface fails to validate a path-traversal template parameter received by the 'api controller.php' endpoint. Subsequently, 'log controller.php' verifies the file existence and executes the View::getView($template) function, which allows an authenticated author to include an arbitrary local .php file when an article is viewed. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.