Is there a patch available for CVE-2026-41517?

Yes, a patch is available for CVE-2026-41517. Update the affected software to the latest version immediately.

Emlog CVE-2026-41517

EUVD-2026-28830 NONE

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-08 security-advisories@github.com

PHP File Upload

Severity by source

GitHub Advisory

0.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Plugin upload is an admin-gated function (PR:H); successful upload and execution extends control beyond the application to the host OS (S:C), yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:37 vuln.today

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 22:16 nvd

NONE

DescriptionGitHub Advisory

Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.

AnalysisAI

Unrestricted PHP file upload via the plugin management interface in Emlog prior to version 2.6.11 enables an attacker to upload and execute arbitrary PHP code, resulting in complete server compromise and persistent backdoor installation. All Emlog deployments below 2.6.11 are affected. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.04% (13th percentile); however, successful exploitation carries critical technical impact - full control of the underlying server.

Technical ContextAI

Emlog is an open-source PHP-based website building and blog CMS. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin upload endpoint fails to validate file type or content, allowing submission of raw .php scripts. Because PHP files uploaded via this mechanism are stored in a web-accessible path and the server interprets them as executable PHP, any uploaded script becomes a live webshell. The PHP execution model is central to the risk - without server-side PHP execution restrictions on upload directories, type-validation bypass directly yields RCE. Affected product is emlog < 2.6.11 per EUVD-2026-28830.

RemediationAI

Vendor-released patch: Emlog 2.6.11. Upgrade immediately to version 2.6.11 or later as documented in GitHub Security Advisory GHSA-8qwx-6jx6-94x4 (https://github.com/emlog/emlog/security/advisories/GHSA-8qwx-6jx6-94x4). If immediate upgrade is not possible, restrict access to the plugin upload and management interface to trusted administrator IP addresses via web server or network controls - note that IP allowlisting does not protect against SSRF-chained abuse and is not a substitute for patching. As an additional defense-in-depth layer, configure the web server (Apache: Options -ExecCGI with php_flag engine off in upload directories; nginx: fastcgi_split_path_info with deny for .php in upload paths) to refuse PHP execution in plugin upload directories, which would prevent webshell activation even if a malicious file is uploaded.