Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-73849: Emlog Unauthenticated Reinstallation via install.php
CVE-2026-73849 · published 20 days ago
Summary
Emlog website builders are at risk of having their configuration files overwritten and new administrator accounts created if an attacker submits malicious data to the install.php page. This is a concern because it could give the attacker control over the website's settings and access to sensitive areas. Users should avoid using the install.php page until a fix is available, and consider updating to a newer version of Emlog if possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| emlog | emlog | <= 2.6.26 |
Original advisory text
emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published14 Aug 2026
Updated3 Sep 2026
First seen14 Aug 2026
Monitor software like this
Free during beta