PT-2026-30256 · Emlog · Emlog

Huajihd · CVE-2026-34228 · Published 2026-04-03 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.8

Description The backend upgrade interface allows the submission of remote SQL and ZIP URLs through GET parameters. The server downloads and executes the SQL file and extracts the ZIP file directly into the web root directory without validating a CSRF (Cross-Site Request Forgery) token—a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts. This allows an attacker to trick an authenticated administrator into visiting a malicious link, resulting in arbitrary SQL execution and arbitrary file write.

Recommendations Update to version 2.6.8.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-34228

GHSA-2RCC-JG83-34VP

Affected Products

Emlog

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34228.json · Exploit
• https://github.com/emlog/emlog/commit/4c3b8f3486e2c9caafee38a5eedb3cd16f8c8d6f · Patch
• https://github.com/emlog/emlog/security/advisories/GHSA-2rcc-jg83-34vp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34228 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34228 · Vendor Advisory
• https://t.me/cveNotify/222521 · Telegram Post