SB20260815117 - Multiple vulnerabilities in Emlog Pro

Description

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-53757)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in the emUnZip() ZIP extraction function when processing uploaded plugin or template ZIP archives. A remote user can upload a specially crafted ZIP archive containing traversal entries to execute arbitrary code.

Exploitation requires access to the administrative plugin, template upload, or store update functionality, and exploitation was confirmed on PHP 7.x and early PHP 8.0.x releases.

2) Cross-site scripting (CVE-ID: CVE-2026-53758)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script code in victims' browsers.

The vulnerability exists due to improper neutralization of input during web page generation in Parsedown article rendering logic in include/lib/function.base.php when processing article content as Markdown. A remote user can create or edit an article containing crafted raw HTML or script content to execute arbitrary script code in victims' browsers.

The injected content is stored and rendered to site visitors, including unauthenticated visitors.

Remediation

Install update from vendor's website.

References

• https://github.com/emlog/emlog/security/advisories/GHSA-gjj4-37r4-mf5g
• https://github.com/emlog/emlog/security/advisories/GHSA-35vc-2gv4-mw77