SQL injection in Emlog article creation and update functions (CVE-2026-42287)

Emlog versions prior to 2.6.11 contain a SQL injection vulnerability in the `addLog()` and `updateLog()` methods of `/include/model/log_model.php`, where user-supplied article data fields are concatenated directly into SQL queries without sanitization or escaping. An unauthenticated or authenticated attacker who can submit article data via `/admin/article_save.php` can execute arbitrary SQL commands, potentially resulting in complete database compromise, sensitive data theft including passwords, unauthorized privilege escalation, or full database destruction. Affected versions: - <2.6.11 We recommend updating to: 2.6.11. CVSS 10.0 · our assessment: act_now Reference: https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw Details: https://vuln.today/cve/CVE-2026-42287