CVE-2026-22799 (CNNVD-202601-1799)
中文标题:
emlog 代码问题漏洞
英文标题:
Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoin
漏洞描述
中文描述:
emlog是emlog开源的一套基于PHP和MySQL的CMS建站系统。 emlog v2.6.1及之前版本存在代码问题漏洞，该漏洞源于REST API端点未对文件类型、扩展名和内容实施适当验证，可能导致经过身份验证的攻击者上传任意文件，包括恶意PHP脚本，从而导致远程代码执行。
英文描述:
Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access to enable the REST API setting, or via information disclosure vulnerabilities in the application. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| emlog | emlog | <= 2.6.1 | - | - |
cpe:2.3:a:emlog:emlog:<=_2.6.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| NVD | nvd_CVE-2026-22799 |
2026-01-13 03:00:04 | 2026-01-13 06:36:23 |
| CVE | cve_CVE-2026-22799 |
2026-01-13 07:35:06 | 2026-01-13 07:40:57 |
| CNNVD | cnnvd_CNNVD-202601-1799 |
2026-01-15 01:52:30 | 2026-01-15 01:53:09 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 代码问题
- cnnvd_id: 未提取 -> CNNVD-202601-1799
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.UNKNOWN -> SeverityLevel.CRITICAL
- cvss_score: 未提取 -> 9.3
- cvss_vector: 未提取 -> CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- cvss_version: 未提取 -> 4.0
- affected_products_count: 0 -> 1
- data_sources: ['nvd'] -> ['cve', 'nvd']