CVE-2026-34607CWE-22

Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE

High · published April 3, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
59.5
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function calls $zip->extractTo($path) without sanitizing ZIP entry names. An authenticated admin can upload a crafted ZIP containing entries with ../ sequences to write arbitrary files to the server filesystem, including PHP webshells, achieving Remote Code Execution (RCE). At time of publication, there are no publicly available patches.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00906 · 59.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-03T22:35Z
EPSS history
Timeline
  • 03 APR 22:35Z
    Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE
    cvelistv5