MEDIUM 6.9 NVD

CVE-2026-53757

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() witho

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite arbitrary files on the server filesystem, including config.php for immediate RCE. At time of publication, there are no publicly known patches.

References

https://github.com/emlog/emlog/security/advisories/GHSA-gjj4-37r4-mf5g

Published: 2026-09-04 · Source: NVD · Feed updated: 2026-09-04

This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-09-04 via NVD.

vulnfeed aggregates 10236 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.