CVE-2026-34788: Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters
Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tagmodel.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escapestring()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Emlogto a version that resolves this vulnerability.Fixed in 2.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34788?
CVE-2026-34788 is considered a high severity SQL injection vulnerability that affects Emlog versions 2.6.2 and prior.
How do I fix CVE-2026-34788?
To fix CVE-2026-34788, upgrade Emlog to version 2.6.3 or later to ensure proper sanitation of user inputs.
What type of vulnerability is CVE-2026-34788?
CVE-2026-34788 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries via unsanitized parameters.
Which software versions are affected by CVE-2026-34788?
CVE-2026-34788 affects Emlog versions up to and including 2.6.2.
Where is the vulnerability located in CVE-2026-34788?
CVE-2026-34788 is located in the include/model/tag_model.php file at line 168 in the Emlog application.