Arbitrary file upload in Emlog Pro - #VU142814
Published: August 15, 2026
Vulnerability identifier: #VU142814
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to unrestricted upload of file with dangerous type in the plugin installation feature when processing ZIP archive uploads through the admin/plugin.php?action=upload_zip endpoint. A remote privileged user can upload a crafted ZIP archive containing a malicious PHP file to execute arbitrary code.
The uploaded archive is extracted into the web-accessible content/plugins/ directory, and the emUnZip() validation only checks for the existence of the expected PHP file without inspecting its contents.
Affected software
Emlog Pro
Remediation
Install security update from vendor's website.
Emlog Pro - update to 2.6.13