The vulnerability is a classic Zip Slip path traversal flaw residing in the emUnZip() function of Emlog. When a ZIP archive is uploaded via the plugin or template upload interface, the system extracts all entries using ZipArchive::extractTo() without validating the inner paths for any ../ traversal sequences, except for the first entry. This allows an attacker to craft an archive that writes arbitrary files to the server’s file system. In particular, overwriting the core config.php file leads directly to remote code execution. The flaw is classified as CWE‑22: Path Traversal.

The issue affects the open source website building system Emlog, specifically versions 2.6.29 and earlier of the emlog:emlog product. No other vendors or product versions are listed as impacted.

The CVSS score is 6.9, indicating a medium severity vulnerability. The EPSS score is not available, so it is unclear how frequently the exploitation is attempted or likely to occur in the wild. The vulnerability is not listed in the CISA KEV catalog, which suggests no known high‑profile exploitation. Exploitation requires the attacker to be able to upload a malicious ZIP archive through the plugin/template upload interface. If that upload is permitted for unauthenticated or low‑privileged users, the risk is higher. Without a publicly released patch, the attack remains a potential threat until an update becomes available.