Dylan Leong

**Name of the Vulnerable Software and Affected Versions** Emlog versions prior to 2.6.2 **Description** A path traversal issue exists in the `emUnZip()` function. This occurs during the extraction of ZIP archives, such as when uploading plugins, templates, or importing backups, because the function calls `$zip->extractTo($path)` without sanitizing ZIP entry names. An authenticated administrator can upload a specially crafted ZIP file containing `../` sequences to write arbitrary files to the server filesystem, which can lead to Remote Code Execution (RCE) through the upload of PHP webshells. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Emlog versions prior to 2.6.2 **Description** A Local File Inclusion (LFI) issue exists in the 'admin/plugin.php' endpoint. The `plugin` parameter from the GET request is used in a `require once` path without proper sanitization. If the CSRF (Cross-Site Request Forgery) token check is bypassed, an attacker can include arbitrary PHP files from the server filesystem, which may lead to code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Emlog versions prior to 2.6.2 **Description** A SQL injection issue exists in the `updateTagName()` function within the `include/model/tag model.php` file. The system directly interpolates user input into the SQL query string without employing parameterized queries or proper escaping via `$this->db->escape string()`, allowing for the execution of arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `updateTagName()` function to minimize the risk of exploitation.