CVE-2026-53757CWE-22path-traversal

CVE-2026-53757

published September 4, 2026

CVSS
6.9
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite arbitrary files on the server filesystem, including config.php for immediate RCE. At time of publication, there are no publicly known patches.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00468 · 39.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-04T22:17Z
References (1)
https://github.com/emlog/emlog/security/advisories/GHSA-gjj4-37r4-mf5g · [email protected]
EPSS history
Timeline
  • 06 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 04 SEP 17:47Z
    Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE
    cvelistv5