CyberRota Analysis
AI-GeneratedThe article publishing interface in Emlog versions 2.6.13 and earlier is vulnerable to a path traversal attack due to inadequate validation of template parameters. This flaw allows authenticated authors to include arbitrary local PHP files, potentially leading to unauthorized code execution when articles are viewed. Website administrators using affected versions should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.