CVE-2026-53756: Emlog Blind SQL Injection via Authentication Cookie
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTHKEY to forge. This issue has been patched in version 2.6.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Emlog CMS Proto a version that resolves this vulnerability.Fixed in 2.6.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the value of AUTH_KEY to forge a valid authentication-cookie HMAC signature. This makes exploitation dependent on access to that secret rather than anonymous access alone.
Which deployments are affected?
Emlog CMS Pro versions before 2.6.16 are affected. The vulnerable path is authentication-cookie validation, where the cookie username reaches a database query without filtering.
What should be done if upgrading cannot happen immediately?
Protect and, if exposure is suspected, rotate AUTH_KEY, since it is required to forge the cookie signature used to reach the injection. Upgrade to version 2.6.16 when possible.