What is the CVSS score of CVE-2026-39276?

CVE-2026-39276 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Emlog Pro are affected by CVE-2026-39276?

Emlog Pro v2.6.9 is vulnerable to remote code execution through authenticated upload of crafted ZIP archives to the template system, allowing attackers to write and execute arbitrary PHP code on the…

How to fix or mitigate CVE-2026-39276?

Within 24 hours: Inventory all Emlog Pro instances and confirm version numbers; immediately restrict administrative account access to essential personnel only and review admin user accounts for unauthorized additions. Within 7 days: Subscribe to Emlog Pro vendor security notifications and monitor for patch release; document current template directory contents and file permissions baseline. Within 30 days: Deploy patch to production when vendor releases it, or implement permanent file integrity monitoring and upload restrictions if no patch is released by vendor within 30 days.

Emlog Pro CVE-2026-39276

EUVD-2026-33351 HIGH

Path Traversal (CWE-22)

2026-05-29 cve@mitre.org

GHSA-w926-pxjj-3c5v

PHP Path Traversal

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 20:22 vuln.today

CVSS changed

May 29, 2026 - 20:22 NVD

7.2 (HIGH)

CVE Published

May 29, 2026 - 16:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.

AnalysisAI

Authenticated remote code execution in Emlog Pro v2.6.9 stems from a path traversal flaw in the template upload feature that lets administrators write arbitrary PHP files outside the intended template directory. Attackers leverage crafted ZIP archives containing '../' sequences in member filenames to overwrite default template files or drop new PHP payloads inside the active template, yielding code execution under the web server account. No public exploit identified at time of analysis, but a vulnerability report repository on GitHub demonstrates the issue.

Technical ContextAI

Emlog Pro is a PHP-based personal blogging platform widely used in Chinese-language communities, and its admin panel exposes a template management feature that accepts ZIP archives. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the ZIP extraction routine fails to canonicalize or sanitize entry filenames before joining them to the destination path. Because PHP's default ZipArchive usage trusts archive metadata, directory traversal sequences in 'name' fields cause files to be written into arbitrary locations under the webroot, and any resulting .php file is directly executable by the interpreter.

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor https://www.emlog.net/ and the project's release channels for a fixed build later than 2.6.9 and upgrade as soon as one is published. In the interim, restrict access to the /admin template-management endpoints via web server ACLs or a WAF rule so only trusted IP ranges can reach the upload handler, enforce strong unique credentials and MFA on every administrator account (since exploitation requires PR:H, this cuts off the realistic attack path), and consider temporarily disabling template installation by removing write permissions on the template directory for the PHP process - note that this will break legitimate theme installs and updates. As an additional control, deploy a server-side check or mod_security rule that rejects ZIP uploads whose entry names contain '..' or absolute paths, accepting the trade-off that some legitimate archives produced by non-conformant tools may also be blocked.