PT-2026-30256 · Emlog · Emlog

Huajihd · Publicado 2026-04-03 · Atualizado 2026-04-03 · CVE-2026-34228

Mitre

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-34228

Produtos afetados

Emlog

Referências · 3

• https://github.com/emlog/emlog/commit/4c3b8f3486e2c9caafee38a5eedb3cd16f8c8d6f · Correção
• https://github.com/emlog/emlog/security/advisories/GHSA-2rcc-jg83-34vp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34228 · Nota de Segurança