Emlog CMS CVE-2026-53757

Exploitation requires an authenticated session with administrator-level privileges on the Emlog instance (PR:H per CVSS vector). The attacker must be able to trigger the emUnZip() function, which is called via ZIP import functionality in the admin panel - this feature must be accessible and not blocked by additional controls. The web server process must have write permissions to the target file (e.g., config.php in the application root). Limiting exploitation: an attacker without administrator credentials cannot reach this code path; installations where the web server runs with hardened, read-only file permissions on the application root are protected against the RCE step even if path traversal occurs in the upload staging area.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N) scores 6.9, reflecting that high privilege (PR:H) is required - exploitation requires an authenticated administrator-level account. The provided vector is conservative: it captures only the direct file-write impact (VI:H) but does not account for the RCE chain through config.php overwrite, which realistically yields confidentiality and availability compromise as well. EPSS data is absent and the CVE is not in CISA KEV, so mass exploitation is not confirmed; however, the lack of any patch and the presence of a public GitHub Security Advisory (GHSA-gjj4-37r4-mf5g) elevate the urgency. Real-world risk is moderate-to-high for deployments with untrusted administrators or shared hosting where multiple users hold admin-level access. The PR:H requirement is the primary limiting factor - this is not exploitable by unauthenticated attackers.

An attacker with administrator credentials to an Emlog instance crafts a ZIP archive containing an entry with a path such as '../../config.php' embedding malicious PHP code. The attacker uploads this archive through the admin panel's import or plugin-install functionality, triggering emUnZip(). Because only the first ZIP entry's path is checked, the traversal entry is extracted, overwriting config.php with a PHP webshell, granting the attacker unauthenticated remote code execution on subsequent requests.