The vulnerability is a local file inclusion flaw in the emlog admin plugin endpoint, where the plugin parameter is used directly in a require_once call without sanitization. This allows an attacker to load arbitrary PHP files from the server if they can bypass the CSRF token check, resulting in execution of arbitrary server‑side code and compromising confidentiality, integrity, and availability of the system.

The affected product is emlog, versions 2.6.2 and earlier, particularly the admin/plugin.php file in the pro edition.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% and absence from the KEV catalog suggest low likelihood of widespread exploitation. The flaw requires successful CSRF token bypass, which may limit the practicality of attacks. Nevertheless, local file inclusion combined with code execution makes it a significant risk if the token check can be avoided.