CVE-2026-34228
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Emlog prior to version 2.6.8 contains a vulnerability in the backend upgrade interface that accepts remote SQL and ZIP URLs via GET parameters. The server downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root. The process does not validate a CSRF token, so an attacker can trick an authenticated administrator into visiting a malicious link, leading to arbitrary SQL execution and file write.
Risk Assessment
The risk includes full server compromise, data theft, and the possibility of deploying malware.
Recommendation
Immediately upgrade Emlog to version 2.6.8, which includes a fix for this vulnerability.
Original NVD description (English source)
Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.