CVE-2026-34787

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.

• CWE-98

• https://github.com/emlog/emlog/security/advisories/GHSA-7mvq-qj5x-5phmExploit, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34781Electron is a framework for writing cross-platform desktop a…3.3
• CVE-2026-34782Zammad is a web based open source helpdesk/customer support …4.3
• CVE-2026-34783Ferret is a declarative system for working with web data. Pr…8.1
• CVE-2026-34784Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-34785Rack is a modular Ruby web server interface. Prior to versio…7.5
• CVE-2026-34786Rack is a modular Ruby web server interface. Prior to versio…5.3
• CVE-2026-34788Emlog is an open source website building system. In versions…6.5
• CVE-2026-3479DISPUTED: The project has clarified that the documentation w…0
• CVE-2026-34790Endian Firewall version 3.3.25 and prior allow authenticated…8.1
• CVE-2026-34791Endian Firewall version 3.3.25 and prior allow authenticated…8.8
• CVE-2026-34792Endian Firewall version 3.3.25 and prior allow authenticated…8.8
• CVE-2026-34793Endian Firewall version 3.3.25 and prior allow authenticated…8.8