Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M

CVE-2026-53757Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Medium 6.9

In plain English

A medium-severity path traversal in emlog from emlog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite arbitrary files on the server filesystem, including config.php for immediate RCE. At time of publication, there are no publicly known patches.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= 2.6.29

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-gjj4-37r4-mf5g x_refsource_CONFIRM