EUVD-2026-58742Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST to install.php (AV:N/AC:L/PR:N/UI:N) overwrites config.php and creates an admin, giving full data access and site control, so C/I/A all High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.
Articles & Coverage 1
AnalysisAI
Authentication bypass and re-installation abuse in Emlog 2.6.26 and earlier lets a remote unauthenticated attacker POST to install.php with action=reinstall, which deliberately skips the already-installed guard because that check only runs when the action is not 'reinstall'. By supplying attacker-chosen database and admin credentials, the attacker overwrites config.php via file_put_contents and provisions a new administrator account, achieving full takeover of an already-live site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploit requires that install.php remains present and web-accessible on a running Emlog 2.6.26-or-earlier instance (the default state after installation, since the file is not removed) and that the attacker sends action=reinstall in the request, which triggers the flawed guard that runs the installed-check only when the action is not 'reinstall'. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly aligned toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with High impact across confidentiality, integrity, and availability, and the described mechanics - an unauthenticated POST that rewrites config.php and creates an admin - are consistent with that 9.8 rating rather than an inflated score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for internet-facing Emlog sites and sends a single crafted HTTP POST to install.php with action=reinstall and their own database and administrator parameters. The installer skips the already-installed check, overwrites config.php with the attacker's database settings, and creates an attacker-controlled admin account, handing over full control of the site with no authentication or user interaction required. … |
| Remediation | No vendor-released patch identified at time of analysis, so the primary control is to make install.php unreachable: delete or rename install.php on production deployments after setup, or block/deny web access to it at the web server (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately inventory all Emlog deployments and identify those running version 2.6.26 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today