CVE-2026-31954: Emlog asynchronous media file deletion missing CSRF protection
Published Mar 11, 2026
·Updated
Emlog is an open source website building system. In 2.6.6 and earlier, the deleteasync action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
Affected Software
2 affected components
Emlog<=2.6.6
Emlog emlog<=2.6.6
Event History
Mar 11, 2026
CVE Published
via MITRE·07:21 PM
Data Sourced
via MITRE·07:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-31954?
CVE-2026-31954 has a medium severity rating due to its potential for exploitation through CSRF attacks.
2
How do I fix CVE-2026-31954?
To fix CVE-2026-31954, upgrade Emlog to version 2.6.7 or later where CSRF protection for the delete_async action is implemented.
3
What versions of Emlog are affected by CVE-2026-31954?
Emlog versions 2.6.6 and earlier are affected by CVE-2026-31954.
4
What type of vulnerability is CVE-2026-31954?
CVE-2026-31954 is a cross-site request forgery (CSRF) vulnerability due to missing CSRF protection.
5
What is the impact of CVE-2026-31954 on Emlog users?
The impact of CVE-2026-31954 on Emlog users includes the risk of unauthorized deletion of media files.