CVE-2026-22799: Emlog CMS File Upload RCE Vulnerability

CVE-2026-22799 Overview

CVE-2026-22799 is a critical arbitrary file upload vulnerability in Emlog, an open source website building system. The vulnerability exists in emlog v2.6.1 and earlier versions, where the REST API endpoint (/index.php?rest-api=upload) used for media file uploads fails to implement proper validation of file types, extensions, and content. This security flaw allows authenticated attackers with a valid API key or admin session cookie to upload arbitrary files, including malicious PHP scripts, to the server. Successful exploitation enables remote code execution (RCE) on the target server, potentially leading to full server compromise.

Critical Impact

Authenticated attackers can upload malicious PHP scripts via the unvalidated REST API upload endpoint, achieving remote code execution and full server compromise.

Affected Products

• Emlog v2.6.1 and earlier versions
• Emlog installations with REST API enabled
• Servers running vulnerable Emlog instances with accessible upload endpoints

Discovery Timeline

• 2026-01-12 - CVE CVE-2026-22799 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22799

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue stems from the media upload functionality in Emlog's REST API, which processes file uploads without validating the file type, extension, or content. This allows authenticated users to bypass expected restrictions and upload executable server-side scripts.

The attack requires authentication, which can be achieved either by gaining administrator access to enable the REST API setting or by exploiting information disclosure vulnerabilities within the application to obtain valid API keys. Once authentication is obtained, an attacker can craft a request to the vulnerable endpoint to upload a PHP webshell or other malicious scripts.

Upon successful upload, the malicious file is stored in an accessible location on the server. The attacker can then directly access the uploaded PHP file via a web browser, triggering execution of their malicious code with the privileges of the web server process.

Root Cause

The vulnerability originates from missing input validation in the api_controller.php file. The upload handler processes file attachments without invoking any security checks to verify that uploaded files are legitimate media types. This architectural oversight allows the upload of executable PHP files that should be explicitly blocked.

Attack Vector

The attack is network-based and requires the attacker to have valid authentication credentials (API key or admin session cookie). The exploitation flow involves:

1. Obtaining authentication through admin access or information disclosure
2. Crafting a multipart form upload request to /index.php?rest-api=upload
3. Uploading a malicious PHP file (e.g., webshell) as the file attachment
4. Accessing the uploaded file directly via its URL path
5. Executing arbitrary commands on the server with web server privileges

             Output::error('Upload error');
         }
 
+        $uploadCheckResult = Media::checkUpload($attach);
+        if ($uploadCheckResult !== true) {
+            Output::error($uploadCheckResult);
+        }
+
         $ret = '';
         addAction('upload_media', 'upload2local');
         doOnceAction('upload_media', $attach, $ret);

Source: GitHub Commit 429b02f - This patch adds the missing Media::checkUpload() validation call before processing uploaded files, ensuring file type and content validation is performed.

Detection Methods for CVE-2026-22799

Indicators of Compromise

• Unexpected PHP files appearing in media upload directories (typically content/uploadfile/)
• Web server access logs showing POST requests to /index.php?rest-api=upload followed by GET requests to unusual .php files
• New or modified PHP files in upload directories with recent timestamps
• Outbound network connections from the web server process to unknown external hosts

Detection Strategies

• Monitor web server access logs for requests to the REST API upload endpoint, especially from unusual source IPs or with abnormal user agents
• Implement file integrity monitoring on upload directories to detect creation of executable files
• Analyze web application firewall (WAF) logs for multipart uploads containing PHP content-type indicators or PHP file signatures
• Review authentication logs for API key usage patterns that deviate from normal administrative activity

Monitoring Recommendations

• Configure real-time alerting for new .php, .phtml, or other executable files created in media directories
• Deploy endpoint detection solutions to monitor for suspicious process spawning from web server processes
• Establish baseline network behavior for the web server and alert on anomalous outbound connections
• Enable detailed logging on the Emlog REST API to capture authentication attempts and file upload activities

How to Mitigate CVE-2026-22799

Immediate Actions Required

• Upgrade Emlog to the latest patched version that includes commit 429b02fda842254b9b9b39303e9161999c180560
• If unable to upgrade immediately, disable the REST API functionality through the Emlog admin panel
• Rotate all API keys and administrator credentials
• Audit upload directories for any suspicious PHP files and remove unauthorized content

Patch Information

The vulnerability has been addressed in the official Emlog repository. The fix introduces a call to Media::checkUpload() which validates uploaded files before processing. Organizations should apply the patch by updating to the latest Emlog release. Detailed information is available in the GitHub Security Advisory and the commit implementing the fix.

Workarounds

• Disable the REST API feature in Emlog administration settings until patching is complete
• Implement web server configuration rules to deny execution of PHP files in upload directories
• Deploy a web application firewall (WAF) rule to block requests containing PHP file extensions to the upload endpoint
• Restrict access to the REST API endpoint at the network level to trusted IP addresses only

# Apache .htaccess configuration to prevent PHP execution in upload directory
# Place this file in the Emlog upload directory (e.g., content/uploadfile/)
<FilesMatch "\.php$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Alternatively, disable PHP engine entirely for the directory
php_flag engine off