VULNERABILITY INTELLIGENCE

CVE-2026-39276

CVSS score7.2 HIGH

EPSS probability0.78%

CISA KEVNot currently listed

Published2026-05-29

Last modified2026-07-21

Description

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.