Executive brief
Emlog is an open-source website builder used to create and manage web content. An attacker can inject malicious JavaScript code into tag names, which executes when an administrator opens the article editor. This allows the attacker to steal admin credentials, create unauthorized admin accounts, or modify site content without permission.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the article editor template (admin/views/article_write.php). Tag names from the database are rendered directly into a JavaScript href attribute without HTML encoding. Although addslashes() is applied to prevent direct string breakout, an attacker can bypass this by using the HTML entity ' which decodes to a single quote before JavaScript execution. When an admin clicks a poisoned tag, the injected code executes in their browser context. No patches are currently available. Exploitation requires admin access to click the malicious tag in the editor, but the attacker needs only user-level access to create tags.
Affected products
- Emlog Emlog 2.6.29 and prior
Timeline
- 2026-08-01: disclosed: GitHub Security Advisory GHSA-fv6h-wr92-v4pj published
- 2026-09-04: advisory: CVE-2026-73848 published on NVD