CVE-2026-39276

Vulnerability

The template upload feature in Emlog Pro v2.6.9 (and all prior versions) contains a path traversal vulnerability ([1]). When an authenticated administrator uploads a malicious ZIP archive via /admin/template.php, the emUnZip() function does not sanitize filenames containing directory traversal sequences (e.g., ../). This allows files to be written outside the intended template directory, overwriting existing template files such as header.php or footer.php [1].

Exploitation

An attacker must have administrative access to the Emlog backend. The attacker crafts a ZIP archive with filenames that include ../ traversal sequences pointing to the target template directory. Upon uploading and extracting the archive through the template management interface, the system writes the payload files to the traversed location, overwriting legitimate default template files [1]. No additional user interaction beyond the admin's upload action is required.

Impact

Successful exploitation enables arbitrary PHP code execution with the web server's privileges. By overwriting a default template file (e.g., header.php), the attacker achieves full-site remote code execution (RCE), affecting all site visitors who load the compromised page. The malicious code persists within the template structure and may remain even after the uploaded template is deleted [1]. Attackers gain full server control and can insert backdoors for continued access.

Mitigation

No fixed version has been released by the vendor as of the report date [1]. Administrators should restrict backend access via IP allowlisting to reduce attack surface. Manual sanitization of ZIP archive filenames before extraction or disabling the template upload feature for untrusted ZIP files are interim workarounds [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication.