What happened
A SQL injection vulnerability exists in Emlog's built-in AI Assistant backend logic, allowing database manipulation via crafted input to the AI feature's query path. CVSS 8.6 (High).
Why it matters
Shows that bolting AI-assistant features onto legacy CMS codebases can reintroduce classic injection vulnerabilities within the new AI-specific code path; narrow blast radius limited to Emlog's install base.
Attack vector
The queryDatabase function inside the AI Assistant module (ai.php) fails to sanitize input, allowing SQL injection through the CMS's AI-assistant-facing endpoint.
Affected systems
Emlog ≤ 2.6.20
Mitigation
Upgrade Emlog past the fixed version referenced in GHSA-jffg-rpvp-2qx7.