Executive brief
Emlog is an open-source website building and content management system. A security flaw in the plugin management system allows an attacker with administrative access to upload malicious files disguised as plugins. If exploited, this allows the attacker to take complete control of the web server, steal sensitive data, or install persistent backdoors.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in Emlog's plugin upload functionality within '/admin/plugin.php' and '/include/lib/common.php'. The system fails to validate the contents of uploaded ZIP files and uses the 'extractTo' method without scanning for malicious PHP code or preventing path traversal. An attacker with administrative privileges can upload a crafted ZIP file containing a PHP backdoor, which is then extracted to the web directory and can be executed directly. This results in Remote Code Execution (RCE) with the privileges of the web server user. The issue is addressed in version 2.6.11 by implementing file content validation, MIME type checking, and filename sanitization.
Affected products
- Emlog Emlog < 2.6.11
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD