CVE-2026-39276: The template upload feature in Emlog Pro v2

Synopsis

A path traversal flaw in the template upload feature of Emlog Pro v2.6.9 lets an authenticated administrator upload a ZIP archive whose entry filenames contain directory traversal sequences. The bug is reachable over the network and requires an administrator account, no victim interaction needed. Successful exploitation overwrites default template files or drops attacker-controlled PHP into the current template, giving full remote code execution on the server. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment a fixed version ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Emlog Pro admin interface over the network (AV:N).

• AuthenticationRequired

  An administrator account is needed to access the template upload feature (PR:H).

• Victim interactionNot required

  No user has to click or open anything; the attacker drives the upload directly (UI:N).

• Attack complexityDetail

  Attack complexity is low: crafting a ZIP with traversal sequences in filenames is reliable and condition-free (AC:L).

Blast Radius

• Writes attacker-controlled PHP files into the web root, leading to arbitrary code execution under the web server account.
• Overwrites legitimate template files, tampering with site content and persisting a backdoor across sessions.
• Reads any data the PHP process can reach, including database credentials, stored posts, and user records.
• Disrupts availability by corrupting template files the application needs to render pages.