CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor
Attackers can execute arbitrary JavaScript in the article editor via malicious tag names, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73848?
CVE-2026-73848 is a medium-severity cross-site scripting vulnerability in emlog, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.
Weakness: CWE-79
Which versions are affected by CVE-2026-73848?
How do I fix CVE-2026-73848?
No fix has been published for CVE-2026-73848 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73848 being exploited?
There is no known exploitation of CVE-2026-73848 in the wild and no public exploit code.
Sources
Also known as GHSA-fv6h-wr92-v4pj.