PT-2026-2311 · Emlog · Emlog

Hebing123 · Publicado 2026-01-12 · Atualizado 2026-01-21 · CVE-2026-22799

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.1

Description Emlog is a website building system. Versions prior to 2.6.1 expose a REST API endpoint ('/index.php?rest-api=upload') for media file uploads. This endpoint does not properly validate file types, extensions, or content, allowing authenticated attackers with a valid API key or admin session cookie to upload arbitrary files, including malicious PHP scripts. Once uploaded, these files can be executed, potentially leading to remote code execution (RCE) and full server compromise. Attackers can obtain the API key by gaining administrator access or through information disclosure vulnerabilities within the application.

Recommendations Versions prior to 2.6.1 should be updated to version 2.6.1 or later.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-22799

GHSA-P837-MRW9-5X5J

Produtos afetados

Emlog

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22799.json · Exploit
• 🔥 https://github.com/emlog/emlog/security/advisories/GHSA-p837-mrw9-5x5j · Exploit
• https://github.com/emlog/emlog/commit/429b02fda842254b9b9b39303e9161999c180560 · Correção
• https://twitter.com/VulmonFeeds/status/2010914358906282355 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2010836949049704621 · Publicação no Twitter
• https://t.me/cveNotify/149444 · Publicação no Telegram
• https://twitter.com/CCBalert/status/2011094669388603616 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22799 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2010843496383398394 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22799 · Nota de Segurança