CVE-2026-31954 Emlog asynchronous media file deletion missing CSRF protection

None 0.0 Published 11 Mar 2026 Updated 12 Mar 2026

Attackers can force authenticated users to delete media files via CSRF due to missing token validation in Emlog.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-31954?

CVE-2026-31954 is a vulnerability in Emlog Emlog, published on 11 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Weakness: CWE-352

Which versions are affected by CVE-2026-31954?

It affects 1 product.

Products include Emlog Emlog.

How do I fix CVE-2026-31954?

No fix has been published for CVE-2026-31954 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-31954 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31954 exists.

All Emlog Emlog vulnerabilities

Sources

Also known as GHSA-xc26-93qj-rcrw.