CVE-2026-54237 Details
Description
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.
A critical vulnerability allowing unauthenticated remote code execution has been identified in Wavelog versions 1.8 prior to 2.4.2. The issue arises because the application exposes installation-related PHP files without proper access controls, allowing remote attackers to manipulate log files and inject malicious PHP code into configuration files. This vulnerability is particularly concerning as it can lead to the execution of arbitrary code on the server.
Users are advised to upgrade to Wavelog version 2.4.2. If an immediate upgrade is not possible, block external access to the '/install/' directory at the web server level.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wavelog/wavelog/commit/9661efa86eff4598bd1a7ad8ca4ec60e76b6fb25 | [email protected] | Source CodeVendor |
| https://github.com/wavelog/wavelog/pull/3228 | [email protected] | Source CodeVendor |
| https://github.com/wavelog/wavelog/releases/tag/2.4.2 | [email protected] | Release NotesVendor |
| https://github.com/wavelog/wavelog/security/advisories/GHSA-jxjv-chgm-rh36 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wavelog | >= 1.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |