CVE-2026-21430
CriticalSummary
Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.
Risk Assessment
Attackers can force users to publish malicious content or take over their accounts, compromising integrity and confidentiality.
Recommendation
No patched versions are known. Restrict access to article creation and implement CSRF tokens.
Original NVD description (English source)
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available.