SB20260815107 - Arbitrary file upload in Emlog Pro

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260815107

SB20260815107 - Arbitrary file upload in Emlog Pro

Published: August 15, 2026

Security Bulletin ID SB20260815107
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Arbitrary file upload (CVE-ID: N/A)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unrestricted upload of file with dangerous type in the plugin installation feature when processing ZIP archive uploads through the admin/plugin.php?action=upload_zip endpoint. A remote privileged user can upload a crafted ZIP archive containing a malicious PHP file to execute arbitrary code.

The uploaded archive is extracted into the web-accessible content/plugins/ directory, and the emUnZip() validation only checks for the existence of the expected PHP file without inspecting its contents.


Remediation

Install update from vendor's website.

References