CVE-2026-73849: emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause fileputcontents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Block or remove support for unauthenticated reinstallation by ensuring requests to install.php?action=reinstall are rejected unless authenticated/authorized (e.g., add authentication/authorization checks so the already-installed guard also applies for action=reinstall).
Emlog install.php action parameter = reinstall must require authentication (disable unauthenticated reinstall) - Compensating control
Restrict network access to Emlog installation endpoints (e.g., block external access to /install.php) so unauthenticated users cannot reach install.php?action=reinstall.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73849?
CVE-2026-73849 has a critical severity score of 9.8.
How do I fix CVE-2026-73849?
To fix CVE-2026-73849, upgrade to Emlog version 2.6.27 or later where the vulnerability is patched.
What kind of attack does CVE-2026-73849 allow?
CVE-2026-73849 allows unauthenticated remote attackers to reinstall the application without authorization.
Which versions of Emlog are affected by CVE-2026-73849?
Emlog versions 2.6.26 and earlier are affected by CVE-2026-73849.
What are the potential consequences of exploiting CVE-2026-73849?
Exploitation of CVE-2026-73849 could lead to unauthorized access to sensitive data and complete system compromise.