CVE-2026-34228 Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write
An attacker can trick an admin into visiting a malicious link to execute arbitrary SQL and write files via the upgrade interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34228?
CVE-2026-34228 is a high-severity vulnerability in Emlog Emlog, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.
Weakness: CWE-352
Which versions are affected by CVE-2026-34228?
It affects 1 product.
Products include Emlog Emlog.
How do I fix CVE-2026-34228?
No fix has been published for CVE-2026-34228 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34228 exists.
Other vulnerabilities in Emlog Emlog
Sources
Also known as GHSA-2rcc-jg83-34vp.