CVE-2026-53757

Received Received - Intake

Path Traversal in Emlog Prior to 2.6.29

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite arbitrary files on the server filesystem, including config.php for immediate RCE. At time of publication, there are no publicly known patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-53757

EUVD

EUVD-2026-71625

Affected Vendors & Products

Vendor	Product	Version / Range
emlog	emlog	to 2.6.29 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Emlog versions 2.6.29 and prior contain a vulnerability in the emUnZip() function. It extracts ZIP files without properly validating entry paths for directory traversal sequences like ../. This allows attackers to overwrite arbitrary files on the server, including critical files such as config.php, which could lead to remote code execution.

Detection Guidance

Check for emlog installations running versions 2.6.29 or earlier. Inspect ZIP upload functionality for improper path validation. Look for unexpected file modifications in web directories, especially config.php.

Impact Analysis

An attacker could exploit this to overwrite important files on your server, such as configuration files. This could lead to complete system compromise, unauthorized access, or remote code execution, potentially giving attackers full control over your website or server.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is exposed or altered due to the attacker's ability to overwrite files.

Mitigation Strategies

Upgrade to the latest emlog version if available. Disable ZIP upload features if not required. Restrict file write permissions on web directories. Monitor for unauthorized file changes, particularly config.php.

Hi! I’m here to help you understand CVE-2026-53757. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70