EMLOG Pro EUVD-2026-84202

Exploitation requires the target to run EMLOG Pro 2.6.29 with an XSS-reachable input surface, and - critically - a victim with elevated privileges (an administrator) must be tricked into viewing the malicious content, since the webshell-upload chain depends on executing in an authenticated admin's session (UI:R, S:C scope change). The attacker needs no prior authentication to plant/deliver the payload (PR:N), but the shell-upload outcome hinges on the victim already being logged in with upload rights. Limiting factors: mandatory user interaction, dependence on an admin (not arbitrary) victim, and the specific single affected version 2.6.29; there is no automated, no-interaction remote path.

This is a moderate-severity XSS (CVSS 6.1) that should be treated as a real but lower-priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated-to-deliver flaw that requires victim interaction (UI:R) and crosses a security scope (S:C) - consistent with XSS executing in another user's (likely an admin's) browser context. EPSS is very low at 0.14% (3rd percentile), there is no CISA KEV listing, and no confirmed active exploitation, which together argue against widespread mass exploitation. However, a dedicated public write-up/PoC repository from the reporter (ants01 on GitHub) exists, so exploit knowledge is public. The most notable signal is the description's claim that the XSS 'enables attackers to upload a malicious shell' - if the XSS reliably drives a webshell upload on behalf of an authenticated admin, real-world integrity impact would exceed the I:L in the vendor vector and approach code-execution; this escalation path is asserted but not demonstrated in the thin available data and should be verified against the PoC. Net: real issue for exposed EMLOG Pro installs, but the low deployment footprint, low EPSS, no-KEV status, and required user interaction keep it well below urgent-patch tier.

An attacker plants a crafted XSS payload (e.g., in a comment, article field, or other user-supplied input in EMLOG Pro 2.6.29) and lures an authenticated administrator to view it. When the admin's browser renders the payload, attacker JavaScript runs in the admin's session and abuses the file-upload functionality to write a malicious PHP shell, potentially leading to server compromise. A public write-up/PoC by the reporter exists on GitHub, lowering the barrier to reproduction.