Quick answers
- Is CVE-2026-73848 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73848 being exploited in the wild.
- How severe is CVE-2026-73848?
- Informational severity, with a CVSS score of 6.5, published 4 September 2026.
- Which products and versions are affected?
- Emlog 2.6.29 and prior.
- Is there a fix for CVE-2026-73848?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-73848 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-73848?
- Check whether you run Emlog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the article editor template (admin/views/article_write.php). Tag names from the database are rendered directly into a JavaScript href attribute without HTML encoding. Although addslashes() is applied to prevent direct string breakout, an attacker can bypass this by using the HTML entity ' which decodes to a single quote before JavaScript execution. When an admin clicks a poisoned tag, the injected code executes in their browser context. No patches are currently available. Exploitation requires admin access to click the malicious tag in the editor, but the attacker needs only user-level access to create tags.
Affected products
- Emlog Emlog 2.6.29 and prior
Timeline
- 2026-08-01: disclosed: GitHub Security Advisory GHSA-fv6h-wr92-v4pj published
- 2026-09-04: advisory: CVE-2026-73848 published on NVD