Emlog CVE-2026-73847

Exploitation requires all of the following: (1) the target site must run Emlog 2.6.26 or earlier with the AI Assistant feature accessible in the admin panel; (2) an administrator must have logged in recently - specifically within the Lax+POST grace window that Chrome applies to session cookies lacking a SameSite attribute, meaning exploitation is time-bounded to the period immediately following admin authentication; (3) the administrator must actively visit an attacker-controlled web page (UI:R) during that window, typically achieved via phishing or malicious link; (4) the administrator's browser must be Chrome or another browser implementing the Lax+POST temporary behavior. Read queries (SELECT on any non-blog table) succeed with no confirmation code - limiting factor for data exfiltration is purely social engineering success. Write queries to the user table require only the publicly-known confirmation string, not any secret known only to the admin. The blog table is application-level write-protected and cannot be modified. Output redaction for password fields is defeatable by column aliasing, so no special database knowledge is required beyond standard SQL. Full opportunistic mass exploitation is infeasible due to the Chrome timing dependency and mandatory admin interaction.

The CVSS 3.1 score of 6.8 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N accurately captures the conditional but consequential nature of this vulnerability. AC:H is justified by two compounding dependencies: the administrator must be within Chrome's Lax+POST grace window (a timing constraint tied to recent login), and must actively visit an attacker-controlled page. Despite the complexity, C:H/I:H reflects a worst-case outcome of full database exfiltration and administrator account takeover. No EPSS data was provided, preventing quantitative exploitation-probability comparison. The vulnerability is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed. However, the GitHub advisory's granular technical disclosure - naming exact files, parameter names, and bypass techniques - substantially lowers the barrier to independent reproduction. For organizations actively running Emlog, the practical risk exceeds what the 6.8 score alone implies: admin account takeover is the realistic terminal impact. The Chrome-timing dependency prevents fully automated mass exploitation and limits this to targeted or opportunistic phishing-style attacks, but the absence of any patch elevates urgency for compensating controls.

An attacker crafts an HTML page containing a hidden auto-submitting form that POSTs to the victim Emlog site's admin/ai.php with the execute_tool action, a query_database SQL payload reading SELECT username, pwd_hash FROM emlog_user, and the publicly-known confirmation string. The attacker delivers the link via phishing email to an Emlog administrator; if the administrator clicks within Chrome's Lax+POST grace window after their last login, the browser forwards the session cookie with the cross-site request, the SQL executes, and credential hashes are exfiltrated to the attacker. A second forged request then overwrites the administrator's password hash in the user table, granting the attacker direct login access to the Emlog admin panel.