Quick answers
- Is CVE-2026-41517 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41517 being exploited in the wild.
- How severe is CVE-2026-41517?
- Informational severity, with a CVSS score of 9.4, published 8 May 2026.
- Which products and versions are affected?
- Emlog < 2.6.11.
- Is there a fix for CVE-2026-41517?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-41517 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-41517?
- Check whether you run Emlog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in Emlog's plugin upload functionality within '/admin/plugin.php' and '/include/lib/common.php'. The system fails to validate the contents of uploaded ZIP files and uses the 'extractTo' method without scanning for malicious PHP code or preventing path traversal. An attacker with administrative privileges can upload a crafted ZIP file containing a PHP backdoor, which is then extracted to the web directory and can be executed directly. This results in Remote Code Execution (RCE) with the privileges of the web server user. The issue is addressed in version 2.6.11 by implementing file content validation, MIME type checking, and filename sanitization.
Affected products
- Emlog Emlog < 2.6.11
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD