CVE-2026-31954 Details
Description
Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
A cross-site request forgery (CSRF) vulnerability has been identified in Emlog versions through 2.6.6. The issue arises in the 'delete_async' action of the media management feature, where the absence of a CSRF token validation allows for unauthorized deletion of media files. This vulnerability is located in the 'admin/media.php' file, specifically between lines 146 and 150.
To address this vulnerability, add a CSRF token validation by including a call to 'LoginAuth::checkToken()' in the 'delete_async' action before processing the media deletion.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/emlog/emlog/security/advisories/GHSA-xc26-93qj-rcrw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| emlog emlog | <= 2.6.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |