PT-2026-60533 · Emlog · Emlog

CVE-2026-46687 · Publicado 2026-07-16 · Atualizado 2026-07-16

Mitre

CVSS v4.0

7.7

Alta

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api controller.php without validation, and log controller.php later checks file exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

Exploit

Correção

Enumeração de Fraquezas

CWE-24

CWE-98

Identificadores relacionados

CVE-2026-46687

Produtos afetados

Emlog

Referências · 2

• 🔥 https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46687 · Nota de Segurança