VulnerabilityDeferred

CVE-2026-41517

Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation.

NONE 0.0EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.

CVSS 4.0: 0.0 NONECVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-434
Source: security-advisories@github.com

References

https://github.com/emlog/emlog/security/advisories/GHSA-8qwx-6jx6-94x4

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.