{"id":"CVE-2026-54237","summary":"Wavelog: Unauthenticated Remote Code Execution","details":"Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.","aliases":["GHSA-jxjv-chgm-rh36"],"modified":"2026-09-20T11:31:00.278039897Z","published":"2026-09-17T20:14:10.057Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54237.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-862","CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/wavelog/wavelog/releases/tag/2.4.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54237.json"},{"type":"ADVISORY","url":"https://github.com/wavelog/wavelog/security/advisories/GHSA-jxjv-chgm-rh36"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54237"},{"type":"FIX","url":"https://github.com/wavelog/wavelog/commit/9661efa86eff4598bd1a7ad8ca4ec60e76b6fb25"},{"type":"FIX","url":"https://github.com/wavelog/wavelog/pull/3228"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wavelog/wavelog","events":[{"introduced":"b2ebcaa40d9312b3494edc55026138fb54478039"},{"fixed":"9661efa86eff4598bd1a7ad8ca4ec60e76b6fb25"},{"fixed":"1e79fd84e8d7d43a6d63eae9efca493dd771e626"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.8"},{"fixed":"2.4.2"}]}}],"versions":["2.4.1","2.4","2.3.1","2.3","2.2.2","2.2.1","2.2","2.1.2","2.1.1","2.1","2.0.7","2.0.6","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0","1.9.1","1.9","1.8.8","1.8.7","1.8.6","1.8.5","1.8.4","1.8.3","1.8.2","1.8","1.8.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54237.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}