Emlog CVE-2026-34607

Emlog versions 2.6.2 and prior. Requires authenticated admin user account. Attacker uploads crafted ZIP archive containing path traversal sequences (../) via plugin/template upload or backup import functionality. No victim interaction needed beyond admin accessing the upload feature.

Real-world risk is elevated but constrained by authentication requirements. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, with network attack vector (AV:N) and low complexity (AC:L), but critically requires high privileges (PR:H - administrator access). The GHSA reference confirms proof-of-concept availability, lowering exploitation barriers for authenticated threat actors. However, the PR:H constraint means this is not exploitable by external unauthenticated attackers or low-privilege users - threat model centers on compromised admin credentials, malicious insiders, or chained attacks following initial access. Absence of vendor patch (no fix version in 2+ years since 2.6.2 release per available data) significantly increases window of exposure for existing installations. The combination of admin-level authentication requirement and active code deployment (ZIP upload) makes this less automatable than unauthenticated RCE, but the availability of POC code and straightforward exploitation (standard ZIP crafting tools) means skilled attackers with admin access can reliably weaponize this. Priority depends on threat model: critical for multi-tenant hosting or environments where admin account compromise is realistic; moderate where admin access controls are robust.

An attacker who has compromised administrator credentials (via phishing, credential stuffing, or session hijacking) authenticates to the Emlog admin panel and navigates to plugin upload or backup import functionality. Using standard ZIP tools, the attacker creates a malicious archive containing an entry named '../../../../var/www/html/shell.php' with PHP webshell payload. Upon upload, the vulnerable emUnZip() function extracts this entry without path sanitization, writing the webshell outside the intended plugins directory into the webroot. The attacker then accesses https://target-site.com/shell.php directly to execute arbitrary system commands with web server privileges, establishing persistent backdoor access for data exfiltration, lateral movement, or complete site compromise. Publicly available exploit code exists via the GitHub Security Advisory, providing ready-made proof-of-concept for attackers.