CVE-2026-34228

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.8

Description The backend upgrade interface allows the submission of remote SQL and ZIP URLs through GET parameters. The server downloads and executes the SQL file and extracts the ZIP file directly into the web root directory without validating a CSRF (Cross-Site Request Forgery) token—a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts. This allows an attacker to trick an authenticated administrator into visiting a malicious link, resulting in arbitrary SQL execution and arbitrary file write.

Recommendations Update to version 2.6.8.