Emlog CVE-2026-73849

The exploit requires that install.php remains present and web-accessible on a running Emlog 2.6.26-or-earlier instance (the default state after installation, since the file is not removed) and that the attacker sends action=reinstall in the request, which triggers the flawed guard that runs the installed-check only when the action is not 'reinstall'. The attacker must supply valid-format hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values. No authentication, no user interaction, and no non-default configuration are needed (AV:N/AC:L/PR:N/UI:N). The main limiting factor is deployment hygiene: environments that have deleted or access-restricted install.php, or that firewall the setup path, are not exploitable.

The signals are strongly aligned toward high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with High impact across confidentiality, integrity, and availability, and the described mechanics - an unauthenticated POST that rewrites config.php and creates an admin - are consistent with that 9.8 rating rather than an inflated score. Key caveats: there is no EPSS value, no KEV listing, and no POC referenced in the provided data, so exploitation is not confirmed as active or automated in the wild, and no SSVC decision data was supplied. The absence of a fixed version raises priority because there is no clean remediation path. Net assessment: this is a genuine high-priority issue on exposed Emlog instances, tempered only by the product's limited deployment footprint and the lack of confirmed active exploitation.

An attacker scans for internet-facing Emlog sites and sends a single crafted HTTP POST to install.php with action=reinstall and their own database and administrator parameters. The installer skips the already-installed check, overwrites config.php with the attacker's database settings, and creates an attacker-controlled admin account, handing over full control of the site with no authentication or user interaction required. No public exploit is referenced, but the low complexity makes reliable exploitation straightforward.