Executive brief
Emlog is an open-source website building platform. An attacker can bypass authentication and reinstall the application remotely, allowing them to overwrite the database configuration and create a new administrator account. This grants complete control over the website and its data with no authentication required.
Technical details
The vulnerability is a missing authentication check (CWE-306) combined with CSRF vulnerability (CWE-352) in install.php. The vulnerable code deliberately bypasses the already-installed check when action=reinstall is set, allowing unauthenticated POST requests to overwrite config.php with attacker-controlled database credentials and create new admin accounts. The attack requires network access to the install.php endpoint; no authentication, privileges, or user interaction are required. An attacker can achieve complete site takeover by redirecting the application to their own database and creating backdoor admin accounts. No fixed version is available as of the advisory date.
Affected products
- emlog Emlog 2.6.26 and earlier
Timeline
- 2026-07-09: disclosed
- 2026-08-14: advisory