CVE-2026-73849 in Emlog
Summary
by MITRE • 08/14/2026
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists in Emlog versions 2.6.26 and earlier where the install.php script contains a critical authentication bypass flaw that allows remote attackers to perform unauthorized reinstallation operations. The vulnerability stems from improper access control implementation where the system accepts action=reinstall parameter without requiring authentication or authorization checks. The technical flaw is rooted in the conditional logic that only executes the existing installation guard when $act != 'reinstall', effectively creating a backdoor that bypasses all security measures designed to prevent unauthorized installations.
The operational impact of this vulnerability is severe as it enables attackers to completely compromise the target system by overwriting the configuration file with malicious database credentials and creating a new administrator account with full privileges. The attacker can control critical system parameters including hostname, database user credentials, password, database name, table prefix, username, password, and email address which are then written to config.php using file_put_contents function. This allows for complete system takeover and persistent access, making it particularly dangerous for production environments where Emlog is deployed as a content management system.
The vulnerability aligns with CWE-287 (Improper Authentication) and CWE-94 (Improper Control of Generation of Code) categories, representing both authentication bypass and code injection risks. From an attack framework perspective, this vulnerability maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as attackers can leverage the compromised system to establish persistent access and potentially use it for further reconnaissance or lateral movement within networks. The lack of a fixed version at the time of review indicates a critical security gap that leaves numerous installations exposed to exploitation.
Organizations using Emlog should immediately implement network-level restrictions to block access to install.php and other installation scripts, particularly in production environments where these files should not be accessible. The recommended mitigation strategy involves enforcing strict authentication controls for all installation and configuration endpoints, implementing proper input validation and sanitization, and ensuring that configuration files are properly protected with appropriate file permissions. Additionally, regular security audits should verify that no installation scripts remain accessible to unauthorized users, and system administrators should monitor for unauthorized modifications to critical configuration files. The vulnerability demonstrates the importance of proper access control implementation and highlights the need for comprehensive security testing of all application entry points, particularly those related to system initialization and configuration management processes.