Emlog, an open source website building system, contains a cross‑site request forgery flaw in its backend upgrade interface that allows an attacker to supply arbitrary SQL and ZIP URLs via GET parameters. Because the interface does not validate a CSRF token, the server blindly downloads and runs the SQL file and extracts the ZIP file directly into the web root directory. This results in the ability to execute arbitrary SQL statements and write unwarranted files to the site’s file system, which can be leveraged by an authenticated administrator who is tricked into visiting a malicious link.

The vulnerability affects all installed instances of emlog CMS running any version earlier than 2.6.8. No other vendors or products are listed as affected by this flaw.

The CVSS score of 8.7 classifies the flaw as high severity, while an EPSS score of less than 1 percent indicates that exploitation activity is currently low. The flaw is not included in the CISA KEV catalog. Exploitation requires an authenticated administrator to click a crafted link that triggers the vulnerable backend upgrade process, making CSRF the most likely attack vector. Because the potential impact is significant, the overall risk remains substantial despite the low current probability of exploitation.