CVE-2026-73847

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allowed attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes.

Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG containing external resource references, causing the server to issue an HTTP request to an attacker-controlled host when processing the file.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.

Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.

In Emlog, an open source website building system, in versions 2.6.29 and prior, tag names are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.

Emlog versions 2.6.29 and prior process article content with Parsedown without enabling safe mode, allowing raw HTML including <script> tags to pass through unescaped. This results in stored XSS visible to all site visitors.

Emlog up to version 2.6.29 has a vulnerability in the emUnZip() function, which extracts ZIP entries without validating paths for ../ traversal sequences. An attacker can overwrite arbitrary files on the server, including config.php, leading to immediate remote code execution (RCE). At the time of publication, there are no publicly known patches.

Emlog before version 2.6.16 has a blind SQL injection vulnerability in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge.