CVE-2026-54237: Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig() and writeconfigfile() in install/includes/core/coreclass.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wavelogto a version that resolves this vulnerability.Fixed in 2.4.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote unauthenticated attacker can exploit it. The affected installation endpoints remain exposed after installation and do not require an installation lock or permission check.
Which deployments are affected?
Wavelog versions from 1.8 through 2.4.2 are described as affected. The issue is fixed in version 2.4.2.
What access does exploitation provide?
An attacker can read or write log files and inject attacker-controlled content into PHP configuration files. That PHP configuration content can then execute on the server.