PT-2026-39198 · Emlog · Emlog

Lan041221 · CVE-2026-41517 · Published 2026-05-08 · Updated 2026-05-09

Positive Technologies (AI Summary)

CVSS v4.0

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.11

Description Insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, which can lead to complete server compromise and the installation of a persistent backdoor.

Recommendations Update to version 2.6.11.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-41517

GHSA-8QWX-6JX6-94X4

Affected Products

Emlog

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41517.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41517 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41517 · Vendor Advisory
• https://github.com/emlog/emlog/security/advisories/GHSA-8qwx-6jx6-94x4 · Note
• https://twitter.com/CVEnew/status/2053131432927826285 · Twitter Post