Emlog CVE-2026-34228

Attacker must trick an authenticated Emlog administrator (versions before 2.6.8) into visiting a malicious link containing crafted GET parameters pointing to remote SQL and ZIP URLs. The backend upgrade interface lacks CSRF token validation, enabling arbitrary SQL execution and file writes to web root.

The CVSS v4.0 score of 8.7 (High severity) reflects significant real-world risk due to the combination of network-based attack vector (AV:N), low attack complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N) from the attacker's perspective. However, the attack does require social engineering to trick an authenticated administrator, which introduces practical friction not fully captured in the base score. The vulnerability enables high integrity impact (VI:H) through arbitrary SQL execution and file writes, creating pathways to full system compromise, web shell deployment, and data manipulation. With publicly available exploit code not identified and no CISA KEV listing, immediate widespread exploitation appears limited. The SSVC decision framework would classify this as exploitation status 'POC' (proof-of-concept exists via detailed advisory), automatable 'No' (requires social engineering), and technical impact 'Total' (arbitrary code execution possible). The primary risk lies in targeted attacks against Emlog installations where administrators can be socially engineered, particularly in environments lacking defense-in-depth controls like Content Security Policy or strict referrer validation. Organizations should prioritize patching if Emlog is internet-facing or administrators operate from potentially compromised networks.

An attacker crafts a malicious webpage containing hidden image tags or JavaScript that generates GET requests to the victim's Emlog backend upgrade interface, embedding URLs pointing to attacker-controlled SQL and ZIP files. When an authenticated Emlog administrator visits this malicious page while logged into their CMS dashboard, their browser automatically sends the requests with valid session cookies. The Emlog server downloads the attacker's SQL file and executes it against the database, potentially creating administrative accounts or exfiltrating credentials. Subsequently, the server downloads and extracts the malicious ZIP archive into the web root, deploying a PHP web shell that grants the attacker persistent remote code execution. The entire attack requires only a single click on a phishing link, with no interaction warnings presented to the victim administrator.