Unrated severityNVD Advisory· Published Mar 11, 2026· Updated Mar 12, 2026
Emlog asynchronous media file deletion missing CSRF protection
CVE-2026-31954
Description
Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
Affected products
2Patches
Vulnerability mechanics
References
1- github.com/emlog/emlog/security/advisories/GHSA-xc26-93qj-rcrwmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.