EUVD-2026-28841Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF needing no attacker auth (PR:N) but requiring admin to interact (UI:R); primary impact is unauthorized admin state change (I:H) with limited confidentiality/availability effect.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This issue has been patched in version 2.6.11.
AnalysisAI
Cross-site request forgery in Emlog, an open-source PHP website/blog building system, allows attackers to force an authenticated administrator's browser into submitting forged requests to critical admin functions in versions prior to 2.6.11, enabling unauthorized system registration, plugin management, and configuration changes. Because Emlog omits anti-CSRF tokens on high-privilege admin endpoints, a single victim click can push administrative state changes with no attacker credentials required. Proof-of-concept exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.02%).
Technical ContextAI
Emlog is a lightweight PHP/MySQL content management and blogging platform. The root cause is CWE-352 (Cross-Site Request Forgery): state-changing administrative actions are exposed as HTTP requests that do not include or validate an unpredictable per-session/per-request anti-CSRF token, so the server cannot distinguish a legitimate admin-initiated request from one forged by an external site. Any authenticated admin session (identified solely by an ambient cookie) can therefore be abused when the administrator visits attacker-controlled content, because the browser automatically attaches the session cookie to the forged request. The GitHub Security Advisory (GHSA-cqqp-rx28-gv2q) identifies plugin management, system registration, and configuration endpoints as the affected admin functions; no specific CPE string was provided in the source data.
RemediationAI
Vendor-released patch: upgrade to Emlog 2.6.11, which adds the missing CSRF protection to the affected admin functions - this is the primary and complete fix, per the GitHub advisory at https://github.com/emlog/emlog/security/advisories/GHSA-cqqp-rx28-gv2q. If an immediate upgrade is not possible, compensating controls include restricting access to the admin interface (the /admin path) by source IP or VPN so that an administrator's authenticated session is never reachable while browsing untrusted sites, and instructing administrators to fully log out of Emlog before browsing elsewhere and to use a dedicated browser/profile for admin tasks; these reduce but do not eliminate exposure and add operational friction. Deploying a reverse proxy or WAF rule that enforces Origin/Referer header checks on state-changing admin POST requests can block cross-site forged requests, though it may break legitimate requests from misconfigured clients or proxies that strip these headers.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today