Path Traversal in Emlog
CVE-2026-39276
The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (64.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 64.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.011 · change: +0.003
Affected products
- Emlog — versions 2.6.9
Weakness classification (CWE)
References
- github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report (Exploit, Third Party Advisory, Mitigation)
- www.emlog.net/ (Product)
Frequently asked questions
- What is CVE-2026-39276?
- CVE-2026-39276 is a high-severity vulnerability in Emlog, classified under Path Traversal. CVSS score: 7.2/10. Published 2026-05-29.
- How severe is CVE-2026-39276?
- High severity. CVSS v3 base score is 7.2 out of 10.