What’s Vulnerable › Vulnerabilities

CVE-2026-39276

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-29 · updated 2026-07-21
• Weakness: CWE-22

Description

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.

Affected products

• emlog: 2.6.9

References

• https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report
• https://www.emlog.net/
• https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report

Get alerted when CVE-2026-39276 or the next vulnerability affects your stack