Wavelog CVE-2026-54237

Requires that the Wavelog installer directory (/install/, specifically ajax.php and includes/interface_assets/triggers.php) remain web-accessible after installation is complete - in vulnerable versions 1.8 through 2.4.1 there was no installation lock file and no permission/token check gating these endpoints, so a remote unauthenticated attacker could re-drive the config-writing routines. No authentication and no user interaction are needed (PR:N/UI:N), but exploitation is limited to deployments that did not manually remove or block the /install/ path; the 2.4.2 fix adds a .lock check and a session-bound X-Installer-Token requirement plus input sanitization and path/URL validation, so patched or install-directory-removed instances are not exploitable.

This is a genuine high-priority issue, not a CVSS-inflation case. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes remote, unauthenticated, low-complexity code injection with full confidentiality/integrity/availability impact, and the description and patch corroborate it: /install/ajax.php and triggers.php remain reachable after installation with no install lock or permission check, and unsanitized input flows into write_config()/write_configfile(), letting an attacker plant PHP that executes on the server. My independent CVSS 3.1 read is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (~9.8), fully consistent with the vendor score. Mitigating the raw severity: exploitation is not entirely condition-free - it requires that the /install/ directory still be web-reachable after setup (many hardened deployments delete or block it), which the fix formalizes with a .lock file and session-bound X-Installer-Token check. On the exploitation-signal side there is no EPSS score, no CISA KEV listing, and no public PoC provided in the intelligence, so there is no public exploit identified at time of analysis; however, the fix commit is public and effectively a recipe (it shows exactly which unsanitized parameters reached the config writers), which shortens the path to a working exploit. Net: high real risk where the install directory is left exposed, tempered by that non-default-persistence prerequisite and the currently niche product footprint.

An attacker discovers an internet-facing Wavelog instance whose /install/ directory was never removed or locked after setup, and sends a crafted unauthenticated request to /install/ajax.php with malicious values for config parameters. Those values are written unsanitized into a generated PHP configuration file, and when that file is included the injected PHP executes on the server, yielding remote code execution. No public PoC is provided, but the public fix commit reveals the exact vulnerable parameters and sink.