# CVE-2026-46687: Emlog Pro local file inclusion in article publishing interface

Source: https://junglewise.ai/threats/cve-2026-46687-emlog-pro-local-file-inclusion-in-article-publishing-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-46687 · Severity: info · CVSS 7.7 · Published 2026-07-16

Emlog is an open-source website building and blogging platform. A security flaw allows an authorized user (such as a blog author) to trick the system into running malicious code by manipulating how article templates are loaded. If an attacker can upload a file to the server through any means, they can use this vulnerability to take full control of the website and its data.

Technologies: [Emlog Pro](https://junglewise.ai/threats/technologies/emlog-pro). Vendors: [Emlog](https://junglewise.ai/threats/vendors/emlog).

## Quick answers

**Is CVE-2026-46687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46687 being exploited in the wild.

**How severe is CVE-2026-46687?** Informational severity, with a CVSS score of 7.7, published 16 July 2026.

**Which products and versions are affected?** Emlog Pro <= 2.6.13.

**Is there a fix for CVE-2026-46687?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46687 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46687?** Check whether you run Emlog Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Local File Inclusion (LFI) vulnerability exists in Emlog Pro versions 2.6.13 and earlier due to improper validation of the 'template' parameter in the article publishing interface. The 'api_controller.php' script fails to sanitize path traversal sequences (../) before storing the template path in the database. When the article is subsequently viewed, 'log_controller.php' retrieves this path and passes it to 'View::getView()', which performs a direct PHP 'include'. An authenticated attacker with author privileges can exploit this to execute arbitrary PHP code, provided they have a method to upload a malicious file elsewhere on the server. No official patch has been identified at the time of this advisory.

## Affected products

- Emlog Emlog Pro <= 2.6.13

## Timeline

- 2026-05-13: advisory: Initial GitHub security advisory published
- 2026-07-16: disclosed: CVE published to NVD dataset

## References

- [https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg](https://github.com/emlog/emlog/security/advisories/GHSA-9h6g-q584-9vfg)

## Related threats

- [EMLOG-Pro cross-site scripting enabling shell upload](https://junglewise.ai/threats/cve-2026-88745-emlog-pro-2-6-29-contains-a-xss-vulnerability-that-enables)
- [Emlog Pro disabled TLS certificate validation in AI service](https://junglewise.ai/threats/cve-2026-67598-emlog-pro-disabled-tls-certificate-validation-in-ai-service)
- [Emlog Pro path traversal in template upload feature](https://junglewise.ai/threats/cve-2026-39276-emlog-pro-path-traversal-in-template-upload-feature)
- [Emlog SQL injection in log_model.php](https://junglewise.ai/threats/cve-2026-42287-emlog-sql-injection-in-log-model-php)
- [Emlog CSRF in admin functions](https://junglewise.ai/threats/cve-2026-42286-emlog-csrf-in-admin-functions)