Emlog
CVE-2026-21430
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious webpage with CSRF token
-
DeliveryTrick authenticated user into visiting page
-
ExploitBrowser auto-submits article creation request
-
ExecutionAttacker injects stored XSS payload
-
ImpactAccount takeover via session hijacking
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Emlog version 2.5.23 with default CSRF token validation disabled or insufficiently implemented. Requires victim to be authenticated and visit attacker-controlled webpage. Article creation endpoint must accept POST requests without proper CSRF token verification. |
| Impact | CVSS 9.3 (Critical). Network vector, low complexity, requires user interaction (visiting attacker's page), scope change. PoC available. No patch available. EPSS 0.03%. |
| Exploit ScenarioDerived | An attacker lures an Emlog admin to a malicious page. The page submits a hidden CSRF form that creates an article with JavaScript that exfiltrates the admin's session cookie. The next admin who views the article list loses their session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Emlog 2.5.23 is vulnerable to CSRF in article creation, which chains with stored XSS to achieve account takeover. An attacker can force an admin to create an article containing malicious JavaScript that steals their session. No patch available.
Earlier versions of this analysis (1)
Emlog 2.5.23 CSRF + stored XSS chain enables unauthenticated attacker to take over admin accounts via forced article creation.
RemediationAI
Implement CSRF tokens on all state-changing endpoints. Sanitize article content to prevent XSS. Consider migrating away from Emlog until patches are released.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The article creation endpoint lacks CSRF protection, allowing an attacker to forge requests that create articles with attacker-controlled content (CWE-79). By injecting JavaScript into the article body, the attacker achieves stored XSS that executes when any user (including admins) views the article, stealing session tokens or performing privileged actions.
Know when Emlog gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available.
Executive ViewAI
Organizations using Emlog face critical risk from CVE-2026-21430, a cross-site scripting vulnerability rated CVSS 9.3. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement Content-Security-Policy headers; (2) Enable HttpOnly and SameSite cookie attributes; (3) Deploy WAF XSS/CSRF rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)GitHub Advisory
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execut
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execut
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to exec
Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code v
A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. Rated critical severity (CVSS 9.8
emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/
emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request w
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php comp
Remote code execution in Emlog v2.6.1 and earlier allows authenticated attackers to upload arbitrary files through an in
Cross-site request forgery in Emlog Pro 2.5.19 and earlier can lead to account takeover of a privileged administrator be
An issue was discovered in emlog 6.0.0stable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. Rated high severity (CVSS 8.8), this vulnerability is remot
Exploit-DB