Emlog, an open source website building system, allows an authenticated author to manipulate the template parameter supplied in the article publishing interface. The system stores this parameter without validation and later uses it to include a PHP file from the server. Because path‑traversal characters are supported, the attacker can cause the system to include and execute any local PHP file, leading to arbitrary code execution on the host. This flaw is a classic local file inclusion weakness, corresponding to CWE‑24 and CWE‑98.

Emlog installations running version 2.6.13 or earlier are impacted. No patched release has been identified, so any site using these vulnerable versions remains at risk until an update becomes available.

The CVSS score of 7.7 classifies the issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only that the attacker have author privileges and can be performed through standard web requests, making it feasible for an internal or compromised account to exploit.