CVE Intelligence
Analysis AI-assisted

CVE-2026-42287: Emlog SQL Injection in Article Creation and Update

CVE-2026-42287 is a critical SQL injection flaw in Emlog's article creation and update functions, affecting versions prior to 2.6.11. The CNA-supplied CVSS 4.0 score is 10.0, and the record states the issue is patched in 2.6.11. The record does not list KEV status or confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Emlog is an open source website building system. The GitHub Security Advisory linked to this CVE describes a direct SQL injection flaw (CWE-89) in the article creation and update functions in versions prior to 2.6.11. The issue is reported as fixed in version 2.6.11.

Impact

  • The CVSS 4.0 vector in the record marks high impact on confidentiality, integrity and availability, with no privileges and no user interaction required.
  • The description states possible outcomes including complete database compromise, data theft or system destruction.

Affected products and versions

  • Product: Emlog.
  • Affected: versions prior to 2.6.11, according to the description.
  • Fixed: version 2.6.11, according to the description.
  • The structured affected and fixes fields in the record are empty, so the exact affected range is known only from the description text.

Exploitation status

The KEV catalog entry for this CVE is not listed in the record, so no active exploitation is confirmed by the sources consulted. The EPSS probability is 0.00386 with a percentile of 0.3075, as provided in the record.

Remediation and mitigation

  • Upgrade Emlog to version 2.6.11 or later.
  • If an upgrade cannot be applied immediately, restrict access to administrative and content-editing functions to trusted users and networks.
  • Review the database account privileges used by the application and apply the principle of least privilege.
  • Maintain verified backups so that data can be restored if integrity is affected.

Detection guidance

  • Review web server and application logs for unusual requests to article creation and editing functions, especially unexpected parameter content or spikes in errors.
  • Watch for database error messages returned to users and for unexpected changes in article or other content tables.
  • Monitor for newly created administrative accounts or unexpected content modifications.

Limitations of the available information

  • The record has no structured affected or fixed version fields and only one advisory reference.
  • The record does not identify the specific parameters or endpoints involved.
  • No public exploit details are included in the record, and this analysis does not provide any.

Frequently asked questions

Which Emlog versions are affected by CVE-2026-42287?

According to the description, versions prior to 2.6.11 are affected. The structured affected-version field in the record is empty.

Is there a fix for this vulnerability?

The description states the issue has been patched in version 2.6.11. Upgrading to that version or later is the recommended remediation.

Is this vulnerability known to be exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.