CVE-2026-21433: Emlog vulnerable to Server-Side Request Forgery (SSRF)
Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG to http[:]//emblog/admin/media[.]php which contains external resource references. When the server processes/renders the SVG (thumbnailing, preview, or sanitization), it issues an HTTP request to the attacker-controlled host. Impact: server-side SSRF/OOB leading to internal network probing and potential metadata/credential exposure. As of time of publication, no known patched versions are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21433?
The severity of CVE-2026-21433 is considered to be high due to its potential for exploitation through SSRF attacks.
How do I fix CVE-2026-21433?
To fix CVE-2026-21433, upgrade Emlog to version 2.5.20 or later where the vulnerability is patched.
What types of attacks can CVE-2026-21433 facilitate?
CVE-2026-21433 can facilitate server-side request forgery (SSRF) attacks through crafted SVG files.
Which versions of Emlog are affected by CVE-2026-21433?
Emlog versions up to and including 2.5.19 are affected by CVE-2026-21433.
Where does the exploitation of CVE-2026-21433 occur?
Exploitation of CVE-2026-21433 occurs through the upload of malicious SVG files to http://emblog/admin/media.php.