CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report	Exploit Mitigation Third Party Advisory
https://www.emlog.net/	Product
https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:emlog:emlog:2.6.9:*:*:*:pro:*:*:*

History

No history.

Information

Published : 2026-05-29 16:16

Updated : 2026-07-21 15:10

NVD link : CVE-2026-39276

Mitre link : CVE-2026-39276

CVE.ORG link : CVE-2026-39276

JSON object : View

Products Affected

emlog

emlog

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-39276", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39276", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T19:31:16.070039Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-29T16:16:26.833", "references": [{"url": "https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.emlog.net/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template."}, {"lang": "es", "value": "La funci\u00f3n de carga de plantillas en Emlog Pro v2.6.9 tiene una vulnerabilidad de salto de ruta, permitiendo a administradores autenticados ejecutar c\u00f3digo PHP arbitrario. Al cargar un archivo ZIP malicioso que contiene secuencias de salto de directorio en los nombres de archivo, un atacante puede sobrescribir archivos de plantilla predeterminados o incluir directamente archivos de c\u00f3digo malicioso en la plantilla actual."}], "lastModified": "2026-07-21T15:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emlog:emlog:2.6.9:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "530ECBE4-6965-462D-B553-A40F214C7F9F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}