CVE-2026-21430

Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:emlog:emlog:2.5.23:*:*:*:pro:*:*:*

History

17 Jun 2026, 10:18

Type	Values Removed	Values Added
Summary		(es) Emlog es un sistema de creación de sitios web de código abierto. En la versión 2.5.23, la funcionalidad de creación de artículos es vulnerable a falsificación de petición en sitios cruzados (CSRF). Esto puede llevar a que un usuario sea forzado a publicar un artículo con contenido arbitrario, controlado por el atacante. Esto, cuando se combina con cross-site scripting almacenado, lleva a la toma de control de la cuenta. A partir del momento de la publicación, no hay versiones parcheadas conocidas disponibles.

16 Jan 2026, 19:07

Type	Values Removed	Values Added
CPE		cpe:2.3:a:emlog:emlog:2.5.23::::pro:::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.3
References	~~() https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q -~~	() https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q - Exploit, Vendor Advisory
First Time		Emlog emlog Emlog

02 Jan 2026, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-02 19:15

Updated : 2026-06-17 10:18

NVD link : CVE-2026-21430

Mitre link : CVE-2026-21430

CVE.ORG link : CVE-2026-21430

JSON object : View

Products Affected

emlog

emlog

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-21430", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21430", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:32:31.928774Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "emlog", "product": "emlog", "versions": [{"status": "affected", "version": "= 2.5.23"}]}]}], "published": "2026-01-02T19:15:47.697", "references": [{"url": "https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "Emlog es un sistema de creaci\u00f3n de sitios web de c\u00f3digo abierto. En la versi\u00f3n 2.5.23, la funcionalidad de creaci\u00f3n de art\u00edculos es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF). Esto puede llevar a que un usuario sea forzado a publicar un art\u00edculo con contenido arbitrario, controlado por el atacante. Esto, cuando se combina con cross-site scripting almacenado, lleva a la toma de control de la cuenta. A partir del momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "lastModified": "2026-06-17T10:18:39.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emlog:emlog:2.5.23:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "CBBD3D75-C2B3-4727-9B9E-6408956E4ADB"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}