CVE-2026-21433: Emlog CMS SSRF Vulnerability via SVG Upload

CVE-2026-21433 Overview

CVE-2026-21433 is a Server-Side Request Forgery (SSRF) vulnerability affecting Emlog, an open source website building system. The vulnerability exists in versions up to and including 2.5.19 and allows attackers to trigger server-side Out-of-Band (OOB) requests through maliciously crafted SVG file uploads. When a specially crafted SVG file containing external resource references is uploaded via the media upload endpoint, the server processes the file and initiates HTTP requests to attacker-controlled hosts.

Critical Impact
This SSRF vulnerability enables internal network probing, potential metadata exposure, and credential theft from cloud service provider metadata endpoints. No patched version is currently available.

Affected Products

Emlog versions up to and including 2.5.19
Emlog installations with SVG upload functionality enabled
Deployments where the web server has access to internal network resources

Discovery Timeline

2026-01-02 - CVE CVE-2026-21433 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21433

Vulnerability Analysis

This vulnerability falls under CWE-918 (Server-Side Request Forgery). The flaw resides in Emlog's media file handling functionality, specifically in how SVG files are processed after upload. The application fails to properly sanitize or validate SVG content before server-side processing operations such as thumbnail generation, preview rendering, or content sanitization.

SVG files can contain embedded references to external resources through various XML elements including <image>, <use>, <foreignObject>, and entity declarations. When the Emlog server processes an uploaded SVG containing these references, it follows the external URLs and initiates HTTP requests from the server's perspective. This allows attackers to leverage the server as a proxy to access internal network resources that would otherwise be inaccessible from the external network.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of SVG file contents during the upload and processing workflow. The media.php endpoint accepts SVG files without properly parsing and removing potentially dangerous XML elements and external entity references before the server-side rendering engine processes them.

The vulnerability is exacerbated by the lack of network-level restrictions on outbound connections from the web server, allowing SSRF requests to reach internal services and cloud provider metadata endpoints.

Attack Vector

The attack requires authenticated access to the Emlog admin panel with media upload permissions. An attacker uploads a maliciously crafted SVG file to the /admin/media.php endpoint. The SVG contains external resource references pointing to attacker-controlled infrastructure or internal network targets.

When the server processes the SVG for thumbnailing, preview generation, or sanitization, it follows the embedded URLs and issues HTTP requests. The attacker can observe incoming requests to confirm SSRF execution and potentially extract sensitive data through DNS exfiltration or response-based techniques.

Common exploitation targets include cloud metadata endpoints (such as http://169.254.169.254/latest/meta-data/ on AWS), internal web services, and network infrastructure management interfaces. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-21433

Indicators of Compromise

Unusual outbound HTTP requests from the web server to internal IP ranges or cloud metadata endpoints
SVG files in the media upload directory containing <image>, <use>, <foreignObject>, or <!ENTITY declarations with external URLs
Web server logs showing requests to /admin/media.php followed by unexpected network connections
DNS query logs showing resolution requests for unusual or attacker-controlled domains from the web server

Detection Strategies

Implement network traffic monitoring to detect outbound connections from the web server to internal RFC1918 addresses or cloud metadata IPs
Deploy file content inspection rules to identify SVG uploads containing external entity declarations or suspicious URL patterns
Enable logging and alerting on the media upload endpoint for authenticated users uploading SVG files
Use web application firewall (WAF) rules to inspect uploaded file contents for SSRF payloads

Monitoring Recommendations

Configure egress firewall rules to log and alert on web server connections to internal network ranges
Implement real-time alerting for HTTP requests to known cloud metadata endpoint IP addresses
Monitor file upload activity in Emlog admin logs for unusual patterns or high-frequency SVG uploads
Set up DNS logging to track query patterns from web server hosts

How to Mitigate CVE-2026-21433

Immediate Actions Required

Disable SVG file uploads in Emlog's media configuration until a patch is available
Restrict admin panel access to trusted IP addresses only
Implement egress filtering to prevent the web server from making connections to internal networks and cloud metadata endpoints
Review existing uploaded SVG files for malicious content and remove any suspicious files

Patch Information

As of the publication date, no patched version of Emlog is available to address this vulnerability. Organizations should monitor the GitHub Security Advisory for updates on patch availability.

Workarounds

Configure web server or firewall rules to block outbound requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints
Modify Emlog's file upload validation to reject SVG files entirely by updating allowed MIME types
Deploy a reverse proxy with request filtering to sanitize SVG content before it reaches the application
Implement network segmentation to isolate the web server from sensitive internal resources

bash

# Example iptables rules to block SSRF to internal networks and cloud metadata
# Block access to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block access to internal RFC1918 ranges from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Block localhost access for SSRF
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP