Executive brief
Emlog is an open-source website builder that allows site administrators to publish articles using Markdown. A vulnerability in versions 2.6.29 and prior fails to sanitize HTML content embedded in articles, allowing attackers with author permissions to inject malicious scripts that execute for all visitors. Attackers can steal admin session cookies, take over accounts, modify site content, or distribute malware.
Technical details
Emlog processes article Markdown using the Parsedown library without enabling safe mode (setSafeMode(true) is not called), allowing raw HTML including <script> and <img onerror> tags to pass through unescaped. The vulnerability is a stored XSS flaw in the article rendering logic (include/lib/function.base.php) where attacker-supplied HTML is persisted and rendered to all site visitors without additional sanitization. The attack requires author or admin privileges to create or edit an article, but impact extends to all visitors including unauthenticated users and administrators. An attacker can steal session cookies, perform unauthorized actions, or deliver malware. At publication, no patches are available.
Affected products
- Emlog Emlog 2.6.29 and prior
Timeline
- 2026-06-10: disclosed
- 2026-09-04: advisory