SB20260815111 - Multiple vulnerabilities in Emlog Pro

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260815111

SB20260815111 - Multiple vulnerabilities in Emlog Pro

Published: August 15, 2026

Security Bulletin ID SB20260815111
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 17% Medium 33% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in an administrator\'s browser and escalate privileges.

The vulnerability exists due to cross-site scripting in the SVG file upload and media library link handling when processing uploaded SVG files that contain malicious JavaScript. A remote user can upload a specially crafted SVG file and have an administrator open it from the media library to execute arbitrary script in an administrator\'s browser and escalate privileges.

User interaction is required for an administrator to browse or click the uploaded file in the media library.


2) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose limited sensitive information.

The vulnerability exists due to cross-site request forgery in the mail test endpoint when handling crafted cross-site requests that submit attacker-controlled SMTP host and port values. A remote attacker can cause the server to initiate SMTP connections to attacker-specified hosts and ports to disclose limited sensitive information.

User interaction is required to trigger the cross-site request.


3) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to missing csrf protection in the execute_tool endpoint when handling cross-site requests to the query_database tool. A remote attacker can cause a logged-in administrator\'s browser to submit a specially crafted request to execute arbitrary SQL commands.

Only instances with AI features enabled are vulnerable. User interaction is required for an administrator to visit a malicious page or click a crafted link.


4) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify other users\' note content.

The vulnerability exists due to authorization bypass through a user-controlled key in the Notes/Twitter update function when handling update requests with a user-supplied id parameter. A remote user can send a specially crafted request to modify other users\' note content.

The issue can also be triggered through cross-site request forgery when a logged-in user visits a malicious page.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to path traversal in the template and plugin deletion functions when handling deletion requests. A remote privileged user can send a specially crafted request with traversal sequences to recursively delete arbitrary files and directories to cause a denial of service.

Exploitation can result in recursive deletion beyond the intended template or plugin directories because the delete routine does not enforce path containment checks.


6) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete arbitrary files on the server.

The vulnerability exists due to external control of file name or path in the media external resource handling and media deletion functionality when processing a user-supplied file:// URI. A remote user can submit a crafted external resource and then delete the media record to delete arbitrary files on the server.

The issue affects users with Writer-role access, and exploitation can lead to site takeover if a critical file such as config.php is deleted and the installer becomes accessible again.


Remediation

Install update from vendor's website.

References