CVE-2026-73848: Emlog: Stored XSS via Tag Name in Article Editor
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create a tag name in Emlog. The malicious tag executes code when it is rendered in the article editor.
Are default deployments affected?
The available information identifies Emlog versions 2.6.29 and prior as affected. It does not state that any non-default configuration or optional component is required beyond use of tag names in the article editor.
How can I determine whether an instance is exposed?
Check whether the deployment runs Emlog 2.6.29 or an earlier version and whether untrusted users can create or control tag names. Review existing tag names for script-breaking payloads, including values resembling ');alert(document.domain);//.
What can be done while no patch is available?
Restrict tag creation and editing to trusted administrators, and remove suspicious or untrusted tag names. Avoid rendering articles in the affected editor until potentially malicious tags have been reviewed.