Emlog Pro EUVD-2026-33351

Exploitation requires a valid Emlog Pro administrator session (CVSS PR:H), network reachability to the admin panel, and the ability to submit a ZIP archive through the template upload feature in v2.6.9. The attacker must craft archive entries containing directory traversal sequences ('../') that resolve to a writable, web-accessible location such as the active template directory. UI:N means no victim interaction is needed once admin access is held; the principal limiting factor is the high-privilege precondition, which excludes anonymous internet-wide exploitation and confines realistic risk to environments where admin credentials can be stolen, guessed, or reused.

The CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact but high-privilege flaw: full CIA compromise once exploited, but only an authenticated administrator can trigger it, which substantially narrows the realistic attacker pool. There is no KEV listing and no EPSS score provided in the input, and no public exploit identified at time of analysis, so this should not be treated as a mass-exploitation priority. The practical risk is highest in deployments using shared, weak, or default admin credentials, or where an attacker has already obtained admin access via phishing or credential reuse - in those scenarios this CVE upgrades a panel takeover into full server-level code execution. EUVD lists affected versions as 'n/a n/a', so version coverage beyond v2.6.9 is unconfirmed and should be verified directly with the vendor.

An attacker who has obtained Emlog Pro admin credentials (via phishing, credential stuffing, or a separately exploited auth bypass) logs into the admin panel and uploads a crafted ZIP archive whose entries use '../../' sequences in their filenames. On extraction, a malicious .php file lands in the active template directory or overwrites a core template file, and the attacker then fetches the corresponding URL to execute arbitrary PHP under the web server account, leading to webshell installation and full site compromise.