The flaw lies in the template upload feature of Emlog Pro 2.6.9, where an authenticated administrator can deliver a crafted ZIP archive that contains filenames with directory traversal sequences. Uploading such a file allows the attacker to overwrite existing template files or place new files in the template folder, resulting in the inclusion of arbitrary PHP code during normal site operation. The impact is remote code execution with the privileges of the authenticated admin, enabling full control over the affected web server and data.

This vulnerability affects the Emlog Pro content management system, specifically version 2.6.9; any installation using that version hosts the template upload functionality.

Because the exploitation requires an authenticated administrator account, the risk is limited to environments where strong admin controls are insufficient or where attackers can compromise an admin credential. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.2 indicates a high severity level. Attackers who gain admin access can leverage the path traversal weakness to execute code, making this a serious threat for sites that rely on the template upload feature.