Medium severity6.5NVD Advisory· Published Apr 3, 2026· Updated Apr 13, 2026
CVE-2026-34228
CVE-2026-34228
Description
Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.
Affected products
1Patches
14c3b8f3486e2https://github.com/emlog/emlogvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/emlog/emlog/commit/4c3b8f3486e2c9caafee38a5eedb3cd16f8c8d6fnvdPatch
- github.com/emlog/emlog/security/advisories/GHSA-2rcc-jg83-34vpnvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.