PT-2026-44901 · Emlog Pro · Emlog Pro

Ling12138-Sg · Published 2026-05-29 · Updated 2026-06-11 · CVE-2026-39276

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.6.9

Description The template upload feature contains a path traversal issue, which occurs when an application uses user-supplied input to construct a pathname that is then used in a file operation. This allows authenticated administrators to execute arbitrary PHP code by uploading a malicious ZIP archive containing directory traversal sequences in filenames. This process enables the overwriting of default template files or the direct inclusion of malicious code files within the current template.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39276

Affected Products

Emlog Pro

References · 5

• 🔥 https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39276 · Security Note
• https://twitter.com/VulmonFeeds/status/2060427886826336498 · Twitter Post
• https://emlog.net · Note
• https://t.me/cveNotify/167109 · Telegram Post