What’s Vulnerable › Vulnerabilities
CVE-2026-53757: Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE
- Severity: medium (CVSS 6.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-04 · updated 2026-09-08
- Weakness: CWE-22
Description
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite arbitrary files on the server filesystem, including config.php for immediate RCE. At time of publication, there are no publicly known patches.
Affected products
- emlog: through 2.6.29
References
Get alerted when CVE-2026-53757 or the next vulnerability affects your stack