CVE-2026-22799

The REST API endpoint (/index.php?rest-api=upload) intended for uploading multimedia files does not validate the type, extension, or content of uploaded files in any way. An authenticated attacker with a valid API key or administrator session cookie can send a request containing a malicious PHP script. The API key can be obtained by gaining administrative access and enabling REST API settings or through information disclosure vulnerabilities in the application. After successfully uploading the file, the attacker invokes it directly through a browser or HTTP request, resulting in server-side code execution.

The attacker can achieve remote code execution (RCE) on the target server, leading to its complete compromise — including data theft, backdoor installation, and further lateral movement in the network.

Emlog should be updated to a version containing the fix available in the project repository (commit 429b02fda842254b9b9b39303e9161999c180560 on GitHub). Until updating, it is recommended to disable the REST API functionality in the admin panel and restrict access to the /index.php?rest-api=upload endpoint at the firewall or web server level.

Emlog v2.6.1 and all earlier versions of the Emlog website building system.