CVE-2026-31954

Emlog asynchronous media file deletion missing CSRF protection PUBLISHED

Description (CNA)

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Affected (CNA)

Vendor / product	Versions
emlog / emlog	affected <= 2.6.6

CWE

CWE-352

References

https://github.com/emlog/emlog/security/advisories/GHSA-xc26-93qj-rcrw

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.