by Kastro
Paper/Archive/CVE-2026-54237

CVE-2026-54237

wavelog wavelog — Wavelog: Unauthenticated Remote Code Execution

EPSS 0.8%CVSS 9.3
critical.is priorityof 100
39
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 55.4.554 × 2011.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.

Affected

ProductAffectedFixed inSource
wavelog>= 1.8, < 2.4.2–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/wavelog/wavelog/security/advisories/GHSA-jxjv-chgm-rh36refgithub.com/wavelog/wavelog/pull/3228refgithub.com/wavelog/wavelog/commit/9661efa86eff4598bd1a7ad8ca4ec60e76b6fb25refgithub.com/wavelog/wavelog/releases/tag/2.4.2