Insecure Plugin Upload Vulnerability in Emlog Website Building System
CVE-2026-41517

NONE

Key Information:

Vendor

Emlog

Status
Emlog
Vendor
CVE Published:
8 May 2026

What is CVE-2026-41517?

Emlog, an open-source website building system, contains a vulnerability that allows attackers to exploit insecure plugin upload functionality. This loophole enables the upload and execution of arbitrary PHP code, which could potentially lead to a complete compromise of the server. Attackers could install persistent backdoors, creating further risks to the site's security. This critical issue has been addressed in version 2.6.11 of Emlog, making it essential for users to update to this version or later to mitigate the risk.

Affected Version(s)

emlog < 2.6.11

References

https://github.com/emlog/emlog/security/advisories/GHSA-8...
x_refsource_CONFIRM

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.