The vulnerability is an unsanitized input in EMLOG‑Pro 2.6.29 that permits the injection of cross‑site scripting payloads. By exploiting the flaw, an attacker can upload a file that is processed as a web shell, enabling them to execute arbitrary code with the privileges of the web server. This can lead to complete compromise of the affected hosting environment.

The only product explicitly noted is EMLOG‑Pro, version 2.6.29. No additional vendor or product names are listed, and the supplied references only mention the affected e‑blog platform. Consequently, all installations running EMLOG‑Pro 2.6.29 without a later or patched release are vulnerable.

The CVE has a CVSS score of 6.1, an EPSS score of less than 1%, and is not listed in the CISA KEV catalog. Based on the description, the likely exploit path involves sending a specially crafted upload request over the public web interface. Because the vulnerability allows a cross‑site scripting payload to trigger a malicious shell upload, the risk is significant: successful exploitation could give an attacker full control over the web server. Administrators should consider patching promptly.