What is the CVSS score of CVE-2026-34607?

CVE-2026-34607 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-34607?

Emlog CMS versions 2.6.2 and earlier contain a path traversal vulnerability in the file extraction function that allows authenticated administrators to upload malicious archives and write arbitrary…

How to fix or mitigate CVE-2026-34607?

Within 24 hours: Disable or restrict administrative access to plugin/template upload and backup import functions in Emlog 2.6.2 and earlier; audit recent uploads for suspicious ZIP files. Within 7 days: Upgrade Emlog to the latest available version beyond 2.6.2 if released; if no newer version exists, migrate to an alternative CMS platform or maintain offline operation until patch availability. Within 30 days: Complete migration from Emlog if no patched version is available; implement file integrity monitoring on web directories; conduct forensic analysis for unauthorized PHP files or admin accounts created during vulnerability window.

PHP CVE-2026-34607

HIGH

Path Traversal (CWE-22)

2026-04-03 GitHub_M

RCE Path Traversal PHP

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 03, 2026 - 23:15 vuln.today

CVE Published

Apr 03, 2026 - 22:35 nvd

HIGH 7.2

DescriptionGitHub Advisory

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function calls $zip->extractTo($path) without sanitizing ZIP entry names. An authenticated admin can upload a crafted ZIP containing entries with ../ sequences to write arbitrary files to the server filesystem, including PHP webshells, achieving Remote Code Execution (RCE). At time of publication, there are no publicly available patches.

AnalysisAI

Path traversal in Emlog CMS 2.6.2 and earlier enables authenticated administrators to achieve remote code execution by uploading malicious ZIP archives containing directory traversal sequences. The emUnZip() function fails to sanitize entry paths during plugin/template uploads and backup imports, allowing arbitrary file writes including PHP webshells. CVSS 7.2 (High) with network attack vector and low complexity. No vendor-released patch identified at time of analysis; publicly available exploit code exists via GitHub Security Advisory GHSA-2jg8-rmhm-xv9m.

Technical ContextAI

The vulnerability resides in Emlog's emUnZip() function (include/lib/common.php:793), which implements ZIP archive extraction for administrative features including plugin installation, template uploads, and backup restoration. The function directly calls PHP's ZipArchive::extractTo($path) method without validating or sanitizing individual entry names within the archive. This is a classic CWE-22 (Path Traversal) vulnerability where relative path sequences like '../' in ZIP entry names are processed literally by the filesystem API. Affected product per CPE is cpe:2.3:a:emlog:emlog:*:*:*:*:*:*:*:* covering all versions through 2.6.2. PHP's native ZIP handling does not automatically prevent path traversal - developers must explicitly filter entry names before extraction. When combined with write permissions to webroot directories, this file write primitive becomes RCE by deploying executable PHP code.

RemediationAI

No vendor-released patch identified at time of analysis per GitHub advisory GHSA-2jg8-rmhm-xv9m published without accompanying fix version. Organizations must implement manual mitigations: (1) Modify include/lib/common.php emUnZip() function to validate ZIP entry names before extraction, rejecting entries containing directory traversal sequences like '../', absolute paths, or paths escaping the target directory. Reference implementation should use realpath() verification to ensure extracted files remain within intended boundary. (2) Implement strict file upload validation at application layer to reject ZIP archives containing suspicious entry names before reaching extraction logic. (3) Apply defense-in-depth by restricting filesystem write permissions for the web server process, limiting impact of arbitrary file write. (4) Audit administrative access controls and enable multi-factor authentication for admin accounts to reduce credential compromise risk. (5) Monitor GitHub repository https://github.com/emlog/emlog for future security updates and subscribe to advisory notifications. Consider migrating to actively maintained CMS platforms if vendor does not release timely patches.