Which versions of Emlog are affected by CVE-2026-42287?

Emlog CMS versions prior to 2.6.11 contain a critical SQL injection vulnerability in article management functions that enables complete database compromise if successfully exploited.. A patch is available.

How to fix or mitigate CVE-2026-42287?

Within 24 hours, identify all instances of Emlog CMS deployed in your environment and confirm which versions are currently in use to establish exposure scope. Within 7 days, deploy Emlog version 2.6.11 to all affected systems, prioritizing any internet-facing or publicly accessible instances. By day 30, complete patching of all remaining systems and perform a verification scan to confirm successful deployment of version 2.6.11 across your environment.

Emlog CVE-2026-42287

Q: What is the CVSS score of CVE-2026-42287?

CVE-2026-42287 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28842 CRITICAL

SQL Injection (CWE-89)

2026-05-08 security-advisories@github.com

SQLi

10.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable low-complexity SQLi with total DB impact; PR:N follows the vendor vector though article-write context leaves auth uncertain; scope unchanged as impact stays within the DB backend.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:28 vuln.today

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 22:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.

AnalysisAI

SQL injection in Emlog's article creation and update functions allows attackers to inject arbitrary SQL through unsanitized input, enabling full database compromise, data theft, or destruction of stored content in all versions prior to 2.6.11. The flaw carries a vendor CVSS 4.0 base score of 10.0 and CWE-89 classification; publicly available exploit code exists (SSVC exploitation status: poc) but there is no evidence of active in-the-wild abuse. EPSS is very low (0.03%), consistent with an obscure, low-footprint CMS rather than a mass-targeted enterprise product.

Technical ContextAI

Emlog is an open-source PHP/MySQL website-building and blogging system popular primarily within the Chinese-language community. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the article creation and update handlers concatenate attacker-controlled parameters directly into SQL statements instead of using parameterized queries or prepared statements, so crafted input breaks out of the intended query context. Because Emlog stores all content, user, and configuration data in a single MySQL/MariaDB backend, a successful injection against the article write path exposes the entire database rather than a single table.

RemediationAI

Vendor-released patch: upgrade to Emlog 2.6.11, which remediates the SQL injection in the article creation and update functions per advisory GHSA-xxj8-fc63-j3gw (https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw). Until the upgrade is applied, restrict access to the Emlog admin/author interface and the article write endpoints (e.g. via IP allow-listing or an authentication proxy) so untrusted users cannot reach the vulnerable functions, and place a WAF rule in front of the article create/update parameters to block SQL metacharacters - noting that WAF filtering is bypassable and should be treated as a stopgap, not a fix. Ensure the database account used by Emlog has least-privilege rights (no DROP/FILE where avoidable) to limit blast radius, accepting that this constrains but does not eliminate data theft. Take a verified database backup before upgrading.