Which versions of Emlog are affected by CVE-2026-34228?

Emlog CMS versions before 2.6.8 contain a critical CSRF vulnerability that allows attackers to trick authenticated administrators into executing arbitrary SQL commands and uploading malicious files…

How to fix or mitigate CVE-2026-34228?

Within 24 hours: identify all Emlog CMS deployments and document current versions; immediately restrict backend upgrade interface access via firewall or reverse proxy rules. Within 7 days: upgrade all Emlog installations to version 2.6.8 or later; if upgrade is not feasible, implement SameSite cookie attributes (SameSite=Strict) and CSRF token validation at the web application firewall level. Within 30 days: conduct security awareness training for administrative staff on CSRF attack vectors; perform forensic review of logs for evidence of exploitation or malicious file uploads.

Emlog CVE-2026-34228

Q: What is the CVSS score of CVE-2026-34228?

CVE-2026-34228 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-03 GitHub_M

CSRF Emlog

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 03, 2026 - 23:15 vuln.today

CVE Published

Apr 03, 2026 - 22:28 nvd

HIGH 8.7

DescriptionCVE.org

Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Emlog CMS versions prior to 2.6.8 enables remote attackers to execute arbitrary SQL commands and write arbitrary files to the web root without authentication. The vulnerability exploits an unprotected backend upgrade interface that accepts remote SQL and ZIP URLs via GET parameters, requiring only that an authenticated administrator visit a malicious link. EPSS data not available; no public exploit identified at time of analysis, though exploitation complexity is low given the CSRF nature and network attack vector.

Technical ContextAI

Emlog is an open-source PHP-based content management system. The vulnerability resides in the backend upgrade mechanism, specifically an interface that processes GET parameters containing URLs to remote SQL files and ZIP archives. The affected product (cpe:2.3:a:emlog:emlog) implements this upgrade workflow without CSRF token validation, classified as CWE-352 (Cross-Site Request Forgery). The attack chain involves two stages: first, the server downloads and executes a remote SQL file directly against the database; second, it downloads a ZIP archive and extracts contents into the web root without path validation or integrity checks. This design flaw allows state-changing operations via simple HTTP GET requests, violating the principle that GET requests should be idempotent and safe. The lack of CSRF protection means the victim's authenticated session can be hijacked through social engineering, with the browser automatically including session cookies when requesting the malicious URL.

RemediationAI

Vendor-released patch: Emlog version 2.6.8 resolves this vulnerability by implementing CSRF token validation in the backend upgrade interface. Organizations running affected versions should immediately upgrade to Emlog 2.6.8 or later, available through the official GitHub repository. The specific remediation commit implementing CSRF protection is documented at https://github.com/emlog/emlog/commit/4c3b8f3486e2c9caafee38a5eedb3cd16f8c8d6f. As an interim mitigation for environments unable to upgrade immediately, administrators should restrict access to the backend upgrade interface through IP allowlisting, implement strict referrer validation at the web server level, or disable the upgrade functionality entirely if not actively used. Additionally, educating administrators about CSRF attack vectors and implementing browser-based protections like SameSite cookie attributes can reduce exploitation risk. Review web server access logs for suspicious requests to upgrade endpoints containing external URL parameters as potential indicators of exploitation attempts.