Which versions of Emlog are affected by CVE-2026-46686?

Emlog versions 2.6.13 and earlier contain a reflected cross-site scripting vulnerability in the administrator backend that could allow attackers to lure authenticated administrators to malicious…

How to fix or mitigate CVE-2026-46686?

Within 24 hours, restrict administrative access to trusted IP addresses using firewall rules and limit access to the user-search feature in admin/user.php to essential personnel. Within 7 days, deploy a Web Application Firewall configured to block XSS payloads in the 'keyword' parameter and implement Content Security Policy headers with 'script-src 'self'' to prevent inline script execution. Within 30 days, establish a process to monitor Emlog security advisories for vendor patches targeting version 2.6.14 or later, develop and test an upgrade plan, and conduct security awareness training for all administrative staff on recognizing phishing attacks and suspicious links.

Emlog CVE-2026-46686

Q: What is the CVSS score of CVE-2026-46686?

CVE-2026-46686 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44985 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 GitHub_M

PHP XSS Emlog

8.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Reflected XSS reachable remotely without attacker privileges but requiring admin victim interaction (UI:R); script escapes into the browser authority (S:C) with limited confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 17:46 vuln.today

CVE Published

Jul 16, 2026 - 16:59 cve.org

HIGH 8.5

DescriptionCVE.org

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.

AnalysisAI

Reflected cross-site scripting in Emlog 2.6.13 and earlier lets a remote attacker execute arbitrary JavaScript in an authenticated administrator's backend session by luring the admin to open a crafted link that hits the user-search feature in admin/user.php. The keyword parameter is sanitized with addslashes but never HTML-escaped before it is echoed into a value attribute in admin/views/user.php, so injected markup breaks out of the attribute and runs in the admin's browser. No public exploit identified at time of analysis, and no fixed version currently exists.

Technical ContextAI

Emlog is a PHP-based open-source blogging and website-building CMS (CPE cpe:2.3:a:emlog:emlog). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The developer applied addslashes() to the search keyword, a function intended to escape quotes for SQL/string contexts, not for safe HTML output. Because the value is reflected directly into an HTML value="..." attribute in admin/views/user.php without htmlspecialchars()/HTML-entity encoding, an attacker can supply a payload that terminates the attribute and injects a new tag or event handler, achieving script execution in the DOM of the admin panel.

RemediationAI

No vendor-released patch identified at time of analysis, so no fixed version can be cited; monitor the vendor advisory at https://github.com/emlog/emlog/security/advisories/GHSA-3h87-c3m2-jpj9 for an official fix. As compensating controls: place the admin backend behind IP allow-listing or a VPN so crafted links cannot reach internet-exposed admin sessions; deploy a Content-Security-Policy header (e.g. script-src 'self') to block inline/injected script execution, accepting that inline admin scripts may need refactoring; add a WAF or reverse-proxy rule that HTML-escapes or rejects angle brackets and quote characters in the keyword parameter of admin/user.php, with the trade-off of possible false positives on legitimate searches; and for organizations able to modify source, apply htmlspecialchars() to the keyword value before it is echoed into the value attribute in admin/views/user.php. Reinforce with admin awareness training against clicking untrusted links while logged in.