External risk intelligence

Emlog install.php allows unauthenticated configuration overwrite and administrator creation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73849

Emlog is a web-based content management system. By design, such systems are intended to be deployed as public-facing web applications, making their installation and configuration interfaces reachable via the internet.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Emlog, an open-source website building system, that could allow an unauthenticated remote attacker to overwrite critical configuration files and create new administrator accounts. This issue affects installations running version 2.6.26 and earlier. The main concern is confirming relevance and exposure as no fix is currently available.

Unauthenticated attackers can alter website configuration.
Attackers can create new admin accounts on affected systems.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to the install.php script of an Emlog website. This script, when not properly authenticated and when the action is set to "reinstall", will allow an attacker to provide new database and administrative credentials. The vulnerability can lead to the complete takeover of the website by overwriting its configuration file and creating a new administrator account.

No authentication required.
Triggered by a specific action in install.php.
Full website takeover possible.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated remote attacker could overwrite the Emlog website's configuration file and establish a new administrator account. This could affect the website's database connection settings and lead to the creation of a new administrative user without proper authorization.

Website configuration and database access.
Unauthenticated network requests to `install.php`.
Unauthorized administrative control over the website.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Emlog's installation process allows unauthenticated attackers to overwrite configuration files and create new administrator accounts. The primary responsibility for addressing this falls to the teams managing web applications and their underlying infrastructure, likely the Application or Platform teams. The first practical step involves identifying all Emlog instances, determining their exposure and business criticality, and then coordinating remediation efforts, as no fixed version is currently available.

Confirm Emlog instance ownership and reachability.
Assess business criticality and potential exposure.
Plan coordinated remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Emlog?

Emlog is an open-source content management system used to build and manage websites. Like other web-based platforms, it utilizes a backend database to store content and configuration settings. It is designed to be hosted on web servers, providing users with a framework to publish articles, manage media, and control site settings through a web-based interface.

What does CWE-306 mean for CVE-2026-73849?

CWE-306 refers to a Missing Authentication for Critical Function. In the context of CVE-2026-73849, this means the software fails to verify the identity of the user before performing a sensitive action—specifically, the reinstallation process. Because the application does not require a login to access this function, an attacker can bypass security checks to modify system files and administrative accounts.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends a specific request to the install.php script with the 'reinstall' action parameter. Simply accessing the website normally will not trigger the flaw. The system is only affected when this specific action is invoked, which forces the software to bypass its existing installation checks and allow new, unauthorized configuration data.

Is my Emlog site at risk?

According to Halo Surface Signal, Emlog instances are typically deployed as public-facing web applications. This makes them reachable via the internet, increasing the likelihood that an attacker can interact with the install.php script. If your instance is accessible to the public, it is considered higher risk compared to internal-only tools that require a VPN or private network access.

What should I do since no fix is available?

Since a patch has not been released, your primary goal is to reduce reachability. Locate all Emlog installations in your environment and restrict access to the install.php file at the web server level. Ensure that only authorized personnel can communicate with that specific file, and prioritize monitoring these systems for any unauthorized configuration changes or unexpected new administrator accounts.

References

github.com/emlog/emlog/security/advisories/GHSA-v5qq-p8mp-3gxm

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.