A path traversal flaw exists in the emUnZip() routine of the Emlog website builder, specifically in versions 2.6.2 and earlier. When an authenticated site administrator uploads a ZIP archive—through plugin, template, or backup import—the function extracts files without sanitizing the entry names. Entries containing "../" sequences can be written to arbitrary locations in the server filesystem, allowing placement of PHP webshells and ultimately permitting remote code execution. The weakness corresponds to a classic directory traversal issue (CWE‑22).

The vulnerability affects the Emlog web‑site system, version 2.6.2 and earlier, within the common.php component that implements ZIP extraction for admin‑initiated uploads.

The CVSS score of 7.2 indicates moderate‑to‑high severity, and the EPSS score is reported below 1 %, suggesting low publicly observable exploitation frequency. The vulnerability is not catalogued in the CISA KEV list. Attackers must first authenticate as an administrator, but once they have that privilege, the attack path—uploading a crafted ZIP file—is straightforward and requires no additional conditions. Given the nature of the flaw, exploitation would grant full control over the host filesystem from the perspective of the web application.