What is the CVSS score of CVE-2026-22799?

CVE-2026-22799 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-22799?

Organizations using Emlog face significant risk from CVE-2026-22799, a unrestricted file upload vulnerability rated CVSS 8.8.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22799?

Yes, a public proof-of-concept exploit is available for CVE-2026-22799. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-22799?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

PHP CVE-2026-22799

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-01-12 security-advisories@github.com

PHP RCE Information Disclosure Emlog

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 21, 2026 - 19:13 vuln.today

Public exploit code

Patch released

Jan 21, 2026 - 19:13 nvd

Patch available

CVE Published

Jan 12, 2026 - 22:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access to enable the REST API setting, or via information disclosure vulnerabilities in the application. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

AnalysisAI

Remote code execution in Emlog v2.6.1 and earlier allows authenticated attackers to upload arbitrary files through an insufficiently validated REST API endpoint (/index.php?rest-api=upload), enabling malicious PHP execution on the server. Attackers can exploit this by obtaining valid API credentials through administrator access or information disclosure flaws, then uploading executable scripts to achieve full system compromise. Public exploit code exists for this vulnerability, and affected administrators should apply available patches immediately.

Technical ContextAI

Classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Affects Emlog. Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access to enable the REST API set

RemediationAI

A vendor patch is available — apply it immediately. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.