CVE-2026-41517CWE-434

Emlog: Remote Code Execution via Malicious Plugin Upload

published May 8, 2026

CVSS v4.0
0.0
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.

The record
Technical detail
CVSS v4.0
0.0 · NONE
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-05-08T21:50Z
EPSS history
Timeline
  • 08 MAY 21:50Z
    Emlog: Remote Code Execution via Malicious Plugin Upload
    cvelistv5