# CVE-2026-39276: Emlog Pro path traversal in template upload feature

Source: https://junglewise.ai/threats/cve-2026-39276-emlog-pro-path-traversal-in-template-upload-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-39276 · Severity: info · CVSS 9.1 · Published 2026-05-29

Emlog Pro, a content management system used for blogs and websites, contains a security flaw in its template upload feature. An authorized administrator can upload a specially crafted file that bypasses folder restrictions to overwrite critical system files. This allows the attacker to take complete control of the website and execute malicious code, potentially impacting all site visitors and compromising the underlying server.

Technologies: [Emlog Pro](https://junglewise.ai/threats/technologies/emlog-pro). Vendors: [Emlog](https://junglewise.ai/threats/vendors/emlog).

## Quick answers

**Is CVE-2026-39276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39276 being exploited in the wild.

**How severe is CVE-2026-39276?** Informational severity, with a CVSS score of 9.1, published 29 May 2026.

**Which products and versions are affected?** Emlog Pro Up to and including 2.6.9.

**Is there a fix for CVE-2026-39276?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-39276 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39276?** Check whether you run Emlog Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the Emlog Pro template management module (/admin/template.php) due to insufficient sanitization of filenames within uploaded ZIP archives. The 'emUnZip' function in /admin/template.php and the extraction logic in /include/lib/common.php fail to validate or strip directory traversal sequences (e.g., '../'). An authenticated administrator can upload a ZIP file containing files with traversal paths to overwrite existing PHP files (like header.php) outside the intended template directory. This leads to arbitrary PHP code execution (RCE) with the privileges of the web server. While the vendor has released newer versions (e.g., 2.6.15), users on version 2.6.9 or older should upgrade immediately.

## Affected products

- Emlog Emlog Pro Up to and including 2.6.9

## Timeline

- 2026-04-05: disclosed: Vulnerability discovered and submitted to MITRE/CNVD by researcher LING12138-sg
- 2026-05-29: advisory: CVE-2026-39276 published

## References

- [https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report](https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report)
- [https://www.emlog.net/](https://www.emlog.net/)

## Related threats

- [EMLOG-Pro cross-site scripting enabling shell upload](https://junglewise.ai/threats/cve-2026-88745-emlog-pro-2-6-29-contains-a-xss-vulnerability-that-enables)
- [Emlog Pro disabled TLS certificate validation in AI service](https://junglewise.ai/threats/cve-2026-67598-emlog-pro-disabled-tls-certificate-validation-in-ai-service)
- [Emlog Pro local file inclusion in article publishing interface](https://junglewise.ai/threats/cve-2026-46687-emlog-pro-local-file-inclusion-in-article-publishing-interface)
- [Emlog SQL injection in log_model.php](https://junglewise.ai/threats/cve-2026-42287-emlog-sql-injection-in-log-model-php)
- [Emlog CSRF in admin functions](https://junglewise.ai/threats/cve-2026-42286-emlog-csrf-in-admin-functions)