---
id: CVE-2026-54237
title: Wavelog is web-based amateur radio logging software
summary: >-
  Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2,
  Wavelog exposes /install/ajax.php and
  /install/includes/interface_assets/triggers.php after installation without an
  installation lock or permission check. Unsanit…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-94
  - CWE-862
vendor: wavelog
product: wavelog
affected:
  - 'wavelog >= 1.8, < 2.4.2'
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:16:41.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54237'
references:
  - url: >-
      https://github.com/wavelog/wavelog/commit/9661efa86eff4598bd1a7ad8ca4ec60e76b6fb25
    label: security-advisories@github.com
  - url: 'https://github.com/wavelog/wavelog/pull/3228'
    label: security-advisories@github.com
  - url: 'https://github.com/wavelog/wavelog/releases/tag/2.4.2'
    label: security-advisories@github.com
  - url: 'https://github.com/wavelog/wavelog/security/advisories/GHSA-jxjv-chgm-rh36'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-18T17:32:40.827460Z'
cvssSource: cna
epss: 0.00559
epssPercentile: 0.45377
ingestedAt: '2026-09-17T20:28:02.782Z'
---

## Overview

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.