Emlog is vulnerable to remote code execution through a path traversal flaw that allows an authenticated administrator to overwrite arbitrary files on the server filesystem.

This is a path traversal vulnerability (CWE-22) residing in the emUnZip function within include/lib/common.php. An authenticated administrator can exploit this by uploading a malicious ZIP archive containing directory traversal sequences, which are then processed without sanitization, leading to arbitrary file writes.

The ability to achieve remote code execution poses a severe risk to the entire application environment, potentially leading to total system compromise and unauthorized data access. Given the CVSS score of 7.2, this vulnerability represents a high risk to business continuity and data integrity, as it grants an attacker full control over the web server.

Immediate Action: As no official patch is currently available, administrators should restrict plugin and template upload capabilities to trusted users only and implement strict filesystem permissions to limit the web server's write access.

Proactive Monitoring: Monitor server access logs for unusual POST requests directed at upload endpoints and audit the filesystem for unexpected PHP files created in directories where they do not belong.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block ZIP file uploads containing path traversal characters or suspicious file extensions.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Due to the severity of the potential impact and the current absence of an official vendor patch, immediate defensive action is required. Organizations using Emlog should minimize the attack surface by limiting administrative access and implementing robust file integrity monitoring to detect any unauthorized modifications to the server filesystem.