CVE-2026-42286

Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG containing external resource references, causing the server to issue an HTTP request to an attacker-controlled host when processing the file.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.

Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.

In Emlog version 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed.

In Emlog version 2.6.13 and earlier, the 'keyword' parameter in the admin user search module is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected XSS in an administrator's backend session.

A SQL injection vulnerability was found in Emlog version 2.6.2 and earlier in the updateTagName() function in include/model/tag_model.php. The function directly interpolates user input into SQL queries without parameterized queries, allowing SQL injection attacks.