Executive brief
Emlog, an open-source website building system, is vulnerable to an attack that can trick administrators into performing unintended actions. By visiting a malicious website while logged into the Emlog dashboard, an administrator could unknowingly change system settings, register unauthorized keys, or activate malicious plugins. This could lead to a full takeover of the website or unauthorized access to sensitive configuration data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Emlog's administrative interface due to a lack of anti-CSRF token validation in critical components, specifically /admin/auth.php and /admin/plugin.php. An attacker can exploit this by hosting a malicious page that sends unauthorized POST or GET requests to a victim's Emlog instance. If an authenticated administrator visits the malicious page, the attacker can execute actions with the administrator's privileges, including system registration (modifying 'emkey'), plugin activation/deactivation, and plugin deletion. This can lead to remote code execution if a malicious plugin is activated or significant configuration tampering. The issue is addressed in version 2.6.11 by implementing token generation and validation in the LoginAuth class.
Affected products
- Emlog Emlog < 2.6.11
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD