CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Unauthenticated attackers can inject code into PHP configuration files via exposed install scripts, leading to remote code execution on Wavelog servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54237?
CVE-2026-54237 is a critical code injection vulnerability in wavelog, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.
Which versions are affected by CVE-2026-54237?
How do I fix CVE-2026-54237?
No fix has been published for CVE-2026-54237 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-54237 being exploited?
There is no known exploitation of CVE-2026-54237 in the wild and no public exploit code.
Sources
Also known as GHSA-jxjv-chgm-rh36.