# CVE-2026-73850: Emlog SQL injection in queryDatabase function

Source: https://junglewise.ai/threats/cve-2026-73850-emlog-sql-injection-in-querydatabase-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73850 · Severity: info · CVSS 8.6 · Published 2026-08-14

Emlog is an open-source website building system. An SQL injection vulnerability in the queryDatabase function (admin/ai.php) allows authenticated admin users to bypass input validation and execute arbitrary SQL commands. This could lead to unauthorized access to the entire database, theft of sensitive data including user credentials, or complete database destruction.

Technologies: [Emlog](https://junglewise.ai/threats/technologies/emlog). Vendors: [Emlog](https://junglewise.ai/threats/vendors/emlog).

## Quick answers

**Is CVE-2026-73850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73850 being exploited in the wild.

**How severe is CVE-2026-73850?** Informational severity, with a CVSS score of 8.6, published 14 August 2026.

**Which products and versions are affected?** Emlog 2.6.20 and earlier.

**Is there a fix for CVE-2026-73850?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73850 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73850?** Check whether you run Emlog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the queryDatabase() function within admin/ai.php (lines 112-143). The function accepts user-supplied SQL via POST parameter 'params' and executes it against the database with insufficient input validation. Although the code attempts to restrict queries to read-only operations (SELECT/SHOW/DESC/DESCRIBE/EXPLAIN) and block certain keywords, these restrictions can be bypassed using encoding or query stacking techniques. Exploitation requires admin authentication and network access to the admin interface. A successful attack allows an attacker to execute arbitrary SQL commands, potentially exfiltrating sensitive data (usernames, password hashes), reading arbitrary database tables, or modifying/deleting data. No patch has been released for v2.6.20 and earlier.

## Affected products

- Emlog Emlog 2.6.20 and earlier

## Timeline

- 2026-08-01: disclosed: GitHub security advisory GHSA-jffg-rpvp-2qx7 published
- 2026-08-14: advisory: CVE-2026-73850 published on NVD

## References

- [https://github.com/emlog/emlog/security/advisories/GHSA-jffg-rpvp-2qx7](https://github.com/emlog/emlog/security/advisories/GHSA-jffg-rpvp-2qx7)

## Related threats

- [Emlog stored XSS in tag names via article editor](https://junglewise.ai/threats/cve-2026-73848-emlog-stored-xss-in-tag-names-via-article-editor)
- [Emlog stored XSS in Markdown article rendering](https://junglewise.ai/threats/cve-2026-53758-emlog-stored-xss-in-markdown-article-rendering)
- [Emlog path traversal in ZIP extraction enables RCE](https://junglewise.ai/threats/cve-2026-53757-emlog-path-traversal-in-zip-extraction-enables-rce)
- [Emlog unauthenticated installation in install.php](https://junglewise.ai/threats/cve-2026-73849-emlog-unauthenticated-installation-in-install-php)
- [Emlog CSRF in AI Assistant execute_tool leading to database compromise](https://junglewise.ai/threats/cve-2026-73847-emlog-csrf-in-ai-assistant-execute-tool-leading-to-database)