Emlog up to 2.6.29 Article Editor addslashes escape output

Summaryinfo

A vulnerability was found in Emlog up to 2.6.29. It has been declared as critical. This affects the function addslashes of the component Article Editor. The manipulation results in escape output. This vulnerability is reported as CVE-2026-73848. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Emlog up to 2.6.29. Affected is the function addslashes of the component Article Editor. The manipulation with an unknown input leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-73848 since 08/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/04/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Emlog

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.6.10
• 2.6.11
• 2.6.12
• 2.6.13
• 2.6.14
• 2.6.15
• 2.6.16
• 2.6.17
• 2.6.18
• 2.6.19
• 2.6.20
• 2.6.21
• 2.6.22
• 2.6.23
• 2.6.24
• 2.6.25
• 2.6.26
• 2.6.27
• 2.6.28
• 2.6.29

Website

• Product: https://github.com/emlog/emlog/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion