CVE-2026-34228
CSRF Allows Arbitrary SQL Execution and File Write in Emlog
Publication date: 2026-04-03
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| emlog | emlog | to 2.6.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Emlog, an open source website building system, prior to version 2.6.8. The backend upgrade interface accepts remote SQL and ZIP file URLs via GET parameters without validating a CSRF token. As a result, an attacker can trick an authenticated administrator into visiting a malicious link, which causes the server to download and execute an arbitrary SQL file and then download and extract a ZIP file directly into the web root directory. This leads to arbitrary SQL execution and arbitrary file write on the server.
How can this vulnerability impact me? :
The vulnerability allows an attacker to execute arbitrary SQL commands and write arbitrary files on the server by tricking an authenticated administrator into visiting a malicious link. This can lead to unauthorized data manipulation, data loss, or corruption, as well as the potential for remote code execution or website defacement by placing malicious files in the web root directory.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Emlog to version 2.6.8 or later, where the issue has been patched.
Additionally, avoid allowing authenticated administrators to visit untrusted or suspicious links that could exploit the lack of CSRF token validation in the backend upgrade interface.