Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0078 53.2 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Apr 6 Reserved by mitre May 29 EXPLOIT PUBLISHED — CVE-2026-39276. Public exploit reference added. May 29 Published (CNA: mitre)
The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.
| Date | Event | Detail |
|---|---|---|
| April 6, 2026 | Reserved | Reserved by mitre |
| May 29, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-39276. Public exploit reference added. |
| May 29, 2026 | Published | Published (CNA: mitre) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | n/a | — | n/a | — |
Authoritative record: CVE-2026-39276 at cve.org
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-39276 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.