CVE-2026-22799
HighSummary
Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.
Risk Assessment
An attacker can gain full control over the server, leading to compromise of confidentiality, integrity, and availability of data and services.
Recommendation
It is recommended to immediately update Emlog to a patched version and implement strict validation of uploaded files.
Other vulnerabilities in Emlog
See all- CVE-2026-42286High
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allowed attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes.
- CVE-2026-21433High
Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG containing external resource references, causing the server to issue an HTTP request to an attacker-controlled host when processing the file.
- CVE-2026-73849Critical
Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.
- CVE-2026-42287Critical
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.
- CVE-2026-21430Critical
Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.
- CVE-2026-73850High
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.
- CVE-2026-73847Medium
Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.
- CVE-2026-46687High
In Emlog version 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed.
- CVE-2026-46686High
In Emlog version 2.6.13 and earlier, the 'keyword' parameter in the admin user search module is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected XSS in an administrator's backend session.
- CVE-2026-34788Medium
A SQL injection vulnerability was found in Emlog version 2.6.2 and earlier in the updateTagName() function in include/model/tag_model.php. The function directly interpolates user input into SQL queries without parameterized queries, allowing SQL injection attacks.
Original NVD description (English source)
Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access to enable the REST API setting, or via information disclosure vulnerabilities in the application. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.