CVE-2026-34607: Emlog Path Traversal Vulnerability

CVE-2026-34607 Overview

CVE-2026-34607 is a path traversal vulnerability in Emlog, an open source website building system. The vulnerability exists in the emUnZip() function located in include/lib/common.php at line 793. When extracting ZIP archives during plugin/template uploads or backup imports, the function calls $zip->extractTo($path) without properly sanitizing ZIP entry names, allowing malicious path sequences to be processed.

Critical Impact

An authenticated administrator can upload a crafted ZIP file containing entries with ../ sequences to write arbitrary files to the server filesystem, including PHP webshells, achieving Remote Code Execution (RCE).

Affected Products

• Emlog version 2.6.2 and prior
• Emlog plugin upload functionality
• Emlog template upload and backup import features

Discovery Timeline

• 2026-04-03 - CVE-2026-34607 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34607

Vulnerability Analysis

This path traversal vulnerability (CWE-22) affects the ZIP extraction functionality in Emlog's core library. The vulnerable emUnZip() function processes ZIP archives uploaded through administrative interfaces without validating the file paths contained within the archive entries. When a ZIP file is uploaded through legitimate features such as plugin uploads, template uploads, or backup imports, the function directly extracts the contents using PHP's ZipArchive extractTo() method.

The fundamental issue is the absence of input sanitization on ZIP entry names before extraction. An attacker with administrative access can craft a malicious ZIP archive where the internal file entries contain directory traversal sequences such as ../ to escape the intended extraction directory.

Root Cause

The root cause is improper input validation in the emUnZip() function. The code directly calls $zip->extractTo($path) without iterating through the archive entries to validate that file paths do not contain path traversal sequences. This allows attackers to specify arbitrary destination paths for extracted files by manipulating the internal structure of ZIP archives.

Attack Vector

The attack requires authenticated administrative access to Emlog and leverages the network-accessible upload functionality. An attacker with admin credentials can:

1. Create a malicious ZIP archive containing a PHP webshell with a crafted filename like ../../../webshell.php
2. Upload the ZIP through the plugin upload, template upload, or backup import feature
3. The emUnZip() function extracts the archive without path validation
4. The webshell is written outside the intended directory to a web-accessible location
5. The attacker accesses the webshell URL to execute arbitrary commands on the server

The exploitation mechanism relies on manipulating ZIP archive entry names to include relative path traversal sequences. When the vulnerable extraction function processes these entries, it resolves the paths relative to the extraction directory but follows the traversal sequences, effectively allowing writes to arbitrary locations on the filesystem where the web server has write permissions.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-34607

Indicators of Compromise

• Unexpected PHP files appearing in web-accessible directories outside normal Emlog paths
• ZIP upload activity followed by new file creation in parent directories
• Web server error logs showing path resolution attempts with ../ sequences
• Suspicious admin login activity followed by plugin or template uploads

Detection Strategies

• Monitor file system writes for new PHP files created outside designated upload directories
• Implement file integrity monitoring on critical web server directories
• Review web server access logs for requests to unusual PHP file paths
• Audit administrative actions in Emlog logs for suspicious plugin/template uploads

Monitoring Recommendations

• Configure SentinelOne to detect webshell creation patterns and suspicious PHP file writes
• Set up alerts for new executable files appearing in the web root or parent directories
• Monitor ZIP extraction operations for path traversal attempts
• Enable enhanced logging for administrative upload functionality

How to Mitigate CVE-2026-34607

Immediate Actions Required

• Restrict administrative access to trusted users only
• Implement network-level access controls to limit who can reach the admin interface
• Consider temporarily disabling plugin, template, and backup upload functionality until a patch is available
• Review recently uploaded ZIP files and check for signs of exploitation

Patch Information

At the time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the GitHub Security Advisory for updates from the Emlog maintainers regarding a security fix.

Workarounds

• Modify the emUnZip() function in include/lib/common.php to validate ZIP entry names before extraction
• Reject any ZIP entries containing ../ or absolute paths
• Implement a whitelist approach for allowed extraction paths
• Use a Web Application Firewall (WAF) to inspect and block malicious ZIP uploads

A temporary mitigation can be implemented by adding path validation logic before extraction:

# Validate ZIP entry names before extraction
# Add to emUnZip() function in include/lib/common.php

# Iterate through ZIP entries and reject any with path traversal sequences
for ($i = 0; $i < $zip->numFiles; $i++) {
    $entryName = $zip->getNameIndex($i);
    if (strpos($entryName, '..') !== false || strpos($entryName, '/') === 0) {
        $zip->close();
        return false; // Reject malicious archive
    }
}