Emlog version 2.6.6 and earlier contain a missing CSRF protection check in the delete_async operation, which allows an attacker to trigger the asynchronous media file deletion endpoint without presenting a valid CSRF token. Because the endpoint can be invoked from a victim’s browser session, a malicious user can delete arbitrary media files, thereby compromising the integrity and availability of the site’s content. The weakness is identified as CWE‑352 – Cross‑Site Request Forgery.

The affected systems are deployments of the open‑source website builder emlog, specifically version 2.6.6 and any earlier release. The Common Platform Enumeration for the vulnerable product is cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*, indicating the Pro edition of emlog.

The EPSS score is reported as under 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Even so, because the flaw relies on a CSRF vector that does not require complex prerequisites, an attacker who can induce a user’s browser to send a request to the delete_async endpoint could delete files without needing administrative credentials. The risk remains significant for sites that rely on the integrity of media assets, and the potential impact warrants immediate attention.