Unrated
Emlog: Remote Code Execution via Malicious Plugin Upload
Type: advisorySources: OSV
Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41517
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:09 UTC · Revision 1
Source evidence
Emlog: Remote Code Execution via Malicious Plugin Upload
core-osv · Original sourcePublished 8 May 2026, 21:50 UTC
Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.
osv:CVE-2026-41517
Complete source record
{
"id": "9a71bfd9c729c3250e41bf564aa27bcb9d247c204e52a4eeb8635167e894f722",
"url": "https://osv.dev/vulnerability/CVE-2026-41517",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Emlog: Remote Code Execution via Malicious Plugin Upload",
"summary": "Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.",
"evidence": "osv:CVE-2026-41517",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2026-41517",
"aliases": [
"CVE-2026-41517",
"GHSA-8qwx-6jx6-94x4"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/emlog/emlog",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "73643f0fb99dbb6ae027964ffed20c5a1dd2a487"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.6.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.6.11"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"pro-2.6.10",
"pro-2.6.9",
"pro-2.6.8",
"pro-2.6.7",
"pro-2.6.6",
"pro-2.6.5",
"pro-2.6.4",
"pro-2.6.3",
"pro-2.6.2",
"pro-2.6.1",
"pro-2.6.0",
"pro-2.5.26",
"pro-2.5.25",
"pro-2.5.24",
"pro-2.5.23",
"pro-2.5.22",
"pro-2.5.21",
"pro-2.5.20",
"pro-1.0.0",
"pro-2.5.19",
"pro-2.5.18",
"pro-2.5.17",
"pro-2.5.16",
"pro-2.5.15",
"pro-2.5.14",
"pro-2.5.13",
"pro-2.5.12",
"pro-2.5.11",
"pro-2.5.10",
"pro-2.5.9",
"pro-2.5.8",
"pro-2.5.7",
"pro-2.5.6",
"pro-2.5.5",
"pro-2.5.4",
"pro-2.5.3",
"pro-2.5.2",
"pro-2.5.1",
"pro-2.4.3",
"pro-2.4.2",
"pro-2.4.1",
"pro-2.4.0",
"pro-2.3.18",
"pro-2.3.17",
"pro-2.3.16",
"pro-2.3.15",
"pro-2.3.14",
"pro-2.3.13",
"pro-2.3.12",
"pro-2.3.11",
"pro-2.3.10",
"pro-2.3.9",
"pro-2.3.8",
"pro-2.3.7",
"pro-2.3.6",
"pro-2.3.5",
"pro-2.3.4",
"pro-2.3.2",
"pro-2.3.1",
"pro-2.3.0",
"pro-2.2.11",
"pro-2.2.10",
"pro-2.2.9",
"pro-2.2.8",
"pro-test-02",
"pro-test-01",
"pro-2.2.7",
"pro-2.2.6",
"pro-2.2.5",
"pro-2.2.4",
"pro-2.2.3",
"pro-2.2.2",
"pro-2.2.1",
"pro-2.2.0",
"pro-2.1.15",
"pro-2.1.14",
"pro-2.1.13",
"pro-2.1.12",
"ci",
"pro-2.1.11",
"pro-2.1.10",
"pro-2.1.9",
"pro-2.1.8",
"pro-2.1.7",
"pro-2.1.6",
"pro-2.1.5",
"pro-2.1.4",
"pro-2.1.3",
"pro-2.1.2",
"pro-2.1.1",
"pro-2.1.0",
"pro-2.0.3",
"pro-2.0.2",
"pro-2.0.1",
"pro-2.0.0",
"pro-1.9.3",
"pro-1.9.2",
"pro-1.9.1",
"pro-1.9.0",
"pro-1.8.0",
"pro-1.7.1",
"pro-1.7.0",
"pro-1.6.0",
"pro-1.5.1",
"pro-1.5.0.new",
"pro-1.5.0",
"pro-1.4.0",
"pro-1.3.1",
"pro-1.3.0",
"pro-1.2.2",
"pro-1.2.1",
"pro-1.2.0",
"pro-1.1.1",
"pro-1.1.0",
"pro-1.0.8",
"pro-1.0.7",
"pro-1.0.6",
"pro-1.0.5",
"pro-1.0.4",
"pro-1.0.3",
"pro-1.0.2",
"pro-1.0.1",
"6.1.0",
"6.0.0",
"5.3.1",
"emlog_5.3.0",
"emlog_5.2.1",
"emlog_5.2.0",
"emlog_5.1.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41517.json"
}
}
],
"modified": "2026-10-28T02:30:29.626410287Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41517.json",
"https://github.com/emlog/emlog/security/advisories/GHSA-8qwx-6jx6-94x4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-41517"
],
"provider_metadata": {
"cwe_ids": [
"CWE-434"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41517.json"
}
},
"related_cves": [
{
"value": "CVE-2026-41517",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 496683,
"published_at": "2026-05-08T21:50:27.441+00:00"
}