PT-2026-2311 · Emlog · Emlog

Hebing123 · Published 2026-01-12 · Updated 2026-01-21 · CVE-2026-22799

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.1

Description Emlog is a website building system. Versions prior to 2.6.1 expose a REST API endpoint ('/index.php?rest-api=upload') for media file uploads. This endpoint does not properly validate file types, extensions, or content, allowing authenticated attackers with a valid API key or admin session cookie to upload arbitrary files, including malicious PHP scripts. Once uploaded, these files can be executed, potentially leading to remote code execution (RCE) and full server compromise. Attackers can obtain the API key by gaining administrator access or through information disclosure vulnerabilities within the application.

Recommendations Versions prior to 2.6.1 should be updated to version 2.6.1 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-22799

GHSA-P837-MRW9-5X5J

Affected Products

Emlog

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22799.json · Exploit
• 🔥 https://github.com/emlog/emlog/security/advisories/GHSA-p837-mrw9-5x5j · Exploit
• https://github.com/emlog/emlog/commit/429b02fda842254b9b9b39303e9161999c180560 · Patch
• https://osv.dev/vulnerability/CVE-2026-22799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22799 · Security Note
• https://twitter.com/VulmonFeeds/status/2010914358906282355 · Twitter Post
• https://twitter.com/0dayPublishing/status/2010836949049704621 · Twitter Post
• https://t.me/cveNotify/149444 · Telegram Post
• https://twitter.com/CCBalert/status/2011094669388603616 · Twitter Post
• https://twitter.com/CVEnew/status/2010843496383398394 · Twitter Post