Vulnerability Description
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-73848?
CVE-2026-73848 is a documented vulnerability. Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');a...
How severe is CVE-2026-73848?
CVSS scoring is not yet available for CVE-2026-73848. Check NVD for updates.
Is there a patch for CVE-2026-73848?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.