CVE-2026-21433 Details
Description
Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG to http[:]//emblog/admin/media[.]php which contains external resource references. When the server processes/renders the SVG (thumbnailing, preview, or sanitization), it issues an HTTP request to the attacker-controlled host. Impact: server-side SSRF/OOB leading to internal network probing and potential metadata/credential exposure. As of time of publication, no known patched versions are available.
A server-side request forgery (SSRF) vulnerability has been identified in Emlog versions through 2.5.19. This issue arises from the application's handling of uploaded SVG files, which can contain external resource references. When the server processes these SVGs—such as during thumbnail generation or sanitization—it inadvertently sends HTTP requests to the attacker-controlled host. This vulnerability could lead to internal network probing and the exposure of metadata or credentials.
Disable SVG uploads on admin/media.php until a fix is applied. Restrict outbound HTTP requests from the application or rendering hosts to block access to arbitrary external IPs, especially cloud metadata IPs. In the medium to long term, consider performing all rendering of user-provided SVGs in a sandboxed environment with no external network access.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/emlog/emlog/security/advisories/GHSA-6rwr-c8hc-mjj4 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| emlog emlog | <= 2.5.19 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 16, 2026 | Initial Analysis | [email protected] |
| Jan 2, 2026 | New CVE Received | [email protected] |