The vulnerability allows an attacker who has obtained a valid API key or is authenticated with an admin session cookie to upload any file, including executable PHP scripts, to the server. This lack of file type and content validation can give the attacker control to run arbitrary code on the target system, compromising the entire server.

emlog, an open‑source website builder, versions 2.6.1 and older are affected because they expose a REST API endpoint for media uploads. The endpoint is accessed via /index.php?rest-api=upload.

The CVSS score is 9.3, indicating high severity. EPSS is below 1 %, showing a very low documented exploitation rate, and the CVE is not listed in the CISA KEV catalog. The attack requires legitimate authentication, which can be obtained by gaining admin access or exploiting information‑disclosure flaws. Once an attacker uploads a malicious PHP file, it can be executed by accessing the file via the web server, granting remote code execution.