Server-Side Request Forgery Vulnerability in Emlog by Emlog

CVE-2026-21433

What is CVE-2026-21433?

Emlog, an open-source website building system, is susceptible to server-side request forgery (SSRF) through malicious SVG file uploads. This vulnerability allows attackers to upload crafted SVG files which reference external resources. When the Emlog server processes these SVG files—whether for thumbnail creation, previewing, or sanitization—it inadvertently makes HTTP requests to the attacker's controlled server. This behavior can lead to unauthorized probing of internal networks, with the potential risk of exposing sensitive metadata and credentials. Currently, there are no known patched versions to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References