CVE-2026-73848
Received Received - Intake

XSS in Emlog Article Editor via Unencoded Tag Names

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-73848
EUVD
EUVD-2026-71626

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
emlog emlog to 2.6.29 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Emlog versions 2.6.29 and prior have a flaw where tag names in articles are not properly HTML-encoded when rendered in the editor. This allows an attacker to inject JavaScript code via a crafted tag, such as ');alert(document.domain)//. The addslashes() function fails to escape HTML entities like ' which gets decoded back to a single quote by the browser, enabling arbitrary code execution.

Detection Guidance

Check for emlog installations with version 2.6.29 or earlier. Inspect tag names in the article editor for HTML entities like ');alert(document.domain)//. Manually review rendered pages for unexpected JavaScript execution.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of a user's browser session. This could lead to theft of session cookies, account takeover, or defacement of the website. Users viewing affected pages may unknowingly run malicious scripts.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, non-compliance penalties, and loss of user trust.

Mitigation Strategies

Upgrade emlog to the latest version if available. If no patch exists, disable the article editor or restrict user input to prevent tag injection. Monitor for unusual activity in logs or network traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart