CVE-2026-31954
Emlog asynchronous media file deletion missing CSRF protection
Summary
Emlog asynchronous media file deletion missing CSRF protection
Original description
The description as published by the source.
Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov