CVE-2026-53756 Emlog Blind SQL Injection via Authentication Cookie
Attackers can perform blind SQL injection via the authentication cookie to read sensitive database information in Emlog CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53756?
CVE-2026-53756 is a medium-severity SQL injection vulnerability in emlog, published on 4 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.
Weakness: CWE-89
Which versions are affected by CVE-2026-53756?
How do I fix CVE-2026-53756?
No fix has been published for CVE-2026-53756 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-53756 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53756 exists.
Sources
Also known as GHSA-xq97-53c2-vvfg.