Executive brief
Emlog is an open-source website building and content management system. A security flaw in how the system handles uploaded ZIP files (such as plugins or themes) allows an administrator to save files to unauthorized locations on the server. By exploiting this, an attacker could upload a malicious script to take full control of the web server, potentially leading to data theft or a complete site shutdown.
Technical details
A path traversal vulnerability (CWE-22) exists in the emUnZip() function within include/lib/common.php. The root cause is the use of the $zip->extractTo($path) method without prior sanitization of the entry names within the ZIP archive. An authenticated attacker with administrative privileges can trigger this via plugin uploads, template uploads, or backup imports. By including '../' sequences in the filenames within a ZIP archive, the attacker can escape the intended directory and write arbitrary files, such as PHP webshells, to the web root or other sensitive directories. This leads to Remote Code Execution (RCE). As of the advisory date, no official patches are available.
Affected products
- emlog emlog <= 2.6.2
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published by vendor
- 2026-04-03: disclosed: CVE published to NVD