Emlog CVE-2026-73848

The attacker must hold a valid Emlog user account with sufficient privileges to create or edit tags (typically author or contributor role). A privileged victim - an administrator or editor - must subsequently open the article editor view where the malicious tag is rendered. No special server-side configuration is required; the flaw exists in the default tag-rendering code of all Emlog versions through 2.6.29. Exploitation is limited by: (1) the attacker needing an authenticated account capable of tag creation, and (2) a privileged user needing to load the article editor page containing the malicious tag. There is no indication of unauthenticated tag creation being possible in the advisory.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) contains metrics that warrant challenge: PR:N implies no authentication is required to create tags, while UI:N implies no victim interaction is needed - both appear inconsistent with the described attack, where an adversary must hold an Emlog account with tag-creation rights and a privileged user must subsequently open the article editor. The VI:L-only impact rating aligns with XSS (no direct confidentiality or availability impact on the server), but a successful payload executing in an administrator's browser can lead to session-cookie exfiltration or administrative action on behalf of the victim, which some would score higher. There is no CISA KEV entry and no EPSS data available at this stage. No separately published exploit tool exists beyond the researcher proof-of-concept embedded in the GitHub security advisory. Even a mid-sized municipal IT team in inowroclaw running a self-hosted Emlog instance should treat this as a medium-priority remediation effort rather than an emergency, given that exploitation requires an internal attacker account and a victim page-load. The 'RCE' tag applied to this CVE is a metadata error - this is a stored XSS, and no code-execution primitive on the server side is described.

An attacker with a low-privilege Emlog account submits a new tag whose name contains ');alert(document.domain);// with the single quote expressed as the HTML entity '. The tag is stored in the database without triggering addslashes() rejection. When a site administrator opens the article editor, the browser decodes the entity to a literal quote and the JavaScript payload executes in the administrator's session context, enabling session-cookie theft or silent execution of privileged CMS actions. The GitHub security advisory includes a proof-of-concept demonstrating this technique.