What’s Vulnerable › Vulnerabilities

CVE-2026-34607: Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-03 · updated 2026-07-24
• Weakness: CWE-22

Description

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function calls $zip->extractTo($path) without sanitizing ZIP entry names. An authenticated admin can upload a crafted ZIP containing entries with ../ sequences to write arbitrary files to the server filesystem, including PHP webshells, achieving Remote Code Execution (RCE). At time of publication, there are no publicly available patches.

Affected products

• emlog: through 2.6.2

References

• https://github.com/emlog/emlog/security/advisories/GHSA-2jg8-rmhm-xv9m
• https://github.com/emlog/emlog/security/advisories/GHSA-2jg8-rmhm-xv9m

Get alerted when CVE-2026-34607 or the next vulnerability affects your stack