CVE-2026-73849

Executive Summary

CVE-2026-73849 is an unauthenticated configuration-overwrite and administrator-account-creation vulnerability in Emlog, an open-source website building system. In version 2.6.26 and earlier, the installation script install.php accepts an action=reinstall parameter without requiring authentication and deliberately bypasses the existing-installation guard, which only runs when $act != 'reinstall'. A remote, unauthenticated attacker can submit crafted values for hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email to cause file_put_contents('config.php', $config) to overwrite the active configuration with attacker-controlled database settings and to create a new administrator account. As of this review, no fixed version is available, and the vulnerability carries a CVSS score of 9.8 (Critical). The impact is total compromise of the CMS installation: configuration integrity loss, availability disruption, and full administrative control of the affected website.

Technical Analysis

The vulnerability resides in Emlog's installation component, a script conventionally used only during initial deployment. The NVD description identifies the affected endpoint as install.php and the relevant action parameter as action=reinstall. The root cause is a logic error in the already-installed guard: the protection check is executed only when the value of the action variable $act is not equal to 'reinstall'. In other words, the developer intentionally (or accidentally) excluded the reinstall path from the check, assuming that such a destructive operation would never be reachable remotely. An attacker who supplies action=reinstall to install.php therefore reaches the installation/reconfiguration code path without any authentication or prior access.

The vulnerability class is CWE-306 — Missing Authentication for Critical Function. This is not an injection flaw; it is a missing-access-control flaw that allows a network-accessible, state-changing function (reinstallation) to be invoked anonymously. The NVD description confirms that the attack can be carried out remotely (AV:N) with no privileges required (PR:N) and no user interaction (UI:N).

The technical mechanism of exploitation is a server-side file write plus a database write. The installation logic accepts user-supplied values for hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email. These values are subsequently used to build the site configuration in memory ($config) and are written to disk via file_put_contents('config.php', $config). Because no authentication is enforced, a remote attacker can push arbitrary database connection values and admin credentials into the file. Additionally, the installer creates a new administrator account using the supplied username and password, giving the attacker known valid credentials for the CMS.

The attack surface is any Emlog installation with install.php present in the web root. Real-world deployments frequently leave install.php in place after installation, and the "reinstall" action is typically documented only for legitimate site migration or recovery scenarios. The absence of an IP restriction, token, or session check makes this flaw trivially exploitable over plain HTTP as well as HTTPS. Because the vulnerability affects the installation subsystem rather than a dependency, it is likely present in every released version up to and including 2.6.26. Insufficient technical detail is available regarding the exact format of $config or the SQL statements used to create the administrator account, but the attack mechanism described above is sufficient to characterize the impact.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-73849 as of this review; the attack chain below is inferred from the vulnerability class and the details present in the NVD description.

1. Reconnaissance and target identification: An attacker first identifies Emlog-powered websites. This can be done with internet-wide scanning using search engine queries or Shodan dorks such as http.title:"emlog" or http.html:"Powered by emlog". The attacker then confirms that install.php is reachable by requesting it directly and observing an HTTP 200 response or a redirection to a setup page. The tester may also probe install.php?action=reinstall to observe whether the installer responds rather than terminating with an "already installed" error.

2. Triggering the specific flaw: The attacker sends an HTTP POST request to /install.php with the parameter action=reinstall. Because the already-installed guard executes only when $act != 'reinstall', the request bypasses the protection mechanism and enters the reinstall code path without authentication. No session cookies, CSRF tokens, or credentials are required.

3. Payload and execution at the vulnerability-class level: In the request body, the attacker submits values for hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email. The hostname value can be an attacker-controlled database server (e.g., a MySQL instance operated by the attacker) or the original database server of the target. The installer takes these values, composes the configuration string $config, and writes it to disk via file_put_contents('config.php', $config). Simultaneously, the installer provisions a new administrator account using the submitted username and password. The result is that the site configuration now points to database credentials of the attacker's choosing, and the attacker possesses valid administrator credentials for the CMS.

4. Post-exploitation impact: With the configuration file overwritten, the legitimate site may be unable to connect to its original database, causing denial of service and defacement of the site's data layer. If the attacker points the configuration at their own database, they can serve an entirely attacker-controlled site under the victim's domain. Regardless of the database choice, the newly created administrator account grants the attacker full administrative access to the CMS. From there, the attacker can modify content, publish malicious pages, exfiltrate user data, and — as is common with content management systems — upload themes or plugins containing arbitrary server-side code, which typically leads to remote code execution on the web server. The full chain, from first request to server compromise, requires no credentials and no user interaction, consistent with the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8.

Impact Assessment

The business impact of CVE-2026-73849 must be considered Critical. The CVSS subscore for both Confidentiality and Integrity impact is High (C:H, I:H, A:H) with an unmodified scope (S:U). In practice, this means an unauthenticated remote attacker can achieve:

• Integrity loss: Replacement of config.php with attacker-controlled database settings, enabling full site content and configuration takeover, including persistent backdoors in the form of a planted administrator account.
• Confidentiality loss: Administrative access to the CMS exposes user records, private content, and database connection metadata; any attacker-controlled database server harvests the site's data plane directly.
• Availability loss: Overwriting the database configuration with invalid or attacker-owned credentials breaks the legitimate site's connection to its data store, causing service outages.
• Escalation potential: CMS administrator privileges are a well-known stepping stone to server-side code execution, which extends the blast radius to the underlying operating system, adjacent virtual hosts, and any services reachable from the web server.

Affected systems are all Emlog deployments running version 2.6.26 or earlier where install.php is present and accessible over the network. Since the affected version list is not formally published by the vendor but the description states "2.6.26 and earlier," older installations should be assumed vulnerable. The most exposed systems are sites that use shared hosting, unmaintained legacy deployments, and instances that never removed or protected install.php after initial setup. The EPSS score has not yet been assigned by FIRST.org, and CISA does not currently list this CVE in KEV; however, the absence of KEV listing should not be interpreted as evidence of low risk — the flaw is trivially scriptable and requires only a single HTTP request.

Detection Guidance

The following detection content targets the characteristic HTTP request pattern of CVE-2026-73849 exploitation: a POST request to install.php containing the action=reinstall parameter and the installer field names hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email. Network and web-server-log detections are the most reliable because the exploitation is network-borne. Complementary detections should monitor for unexpected creation of administrator accounts and for modification of config.php on disk. All rule identifiers below are examples and should be validated against local log schemas before production deployment.

Sigma Rule

title: Emlog install.php Unauthenticated Reinstall Attempt - CVE-2026-73849
id: 4a2b9c3f-7d1e-4f8a-9b2c-3a5d6f7e8c91
status: experimental
description: Detects HTTP POST requests to Emlog install.php with the action=reinstall parameter, indicating an attempt to exploit CVE-2026-73849.
author: Valters IT Threat Intelligence
date: 2026-01-15
logsource:
  category: webserver
  product: apache
detection:
  selection_reinstall:
    cs-method: 'POST'
    cs-uri-path|endswith: '/install.php'
    cs-uri-query|contains: 'action=reinstall'
  selection_payload:
    cs-method: 'POST'
    cs-uri-path|endswith: '/install.php'
    cs-uri-query|contains|any:
      - 'dbuser='
      - 'dbpasswd='
      - 'dbprefix='
  condition: selection_reinstall or selection_payload
falsepositives:
  - Legitimate administrator-initiated site reinstallation (very rare in production)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.73849
  - cwe.306

YARA Rule

rule Emlog_Reinstall_CVE_2026_73849 {
    meta:
        description = "Detects HTTP request bodies or access logs containing Emlog reinstall parameters associated with CVE-2026-73849"
        author = "Valters IT Threat Intelligence"
        date = "2026"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73849"
        cve = "CVE-2026-73849"
    strings:
        $action = "action=reinstall" ascii nocase
        $install = "install.php" ascii nocase
        $dbuser = "dbuser=" ascii nocase
        $dbpass = "dbpasswd=" ascii nocase
        $dbname = "dbname=" ascii nocase
        $dbprefix = "dbprefix=" ascii nocase
        $hostname = "hostname=" ascii nocase
        $username = "username=" ascii nocase
    condition:
        (
            any of ($action, $install) and
            2 of ($dbuser, $dbpass, $dbname, $dbprefix, $hostname, $username)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Emlog install.php reinstall attempt (CVE-2026-73849)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"install.php"; http.uri; content:"action=reinstall"; http.client_body; content:"hostname="; http.client_body; content:"dbuser="; http.client_body; content:"dbpasswd="; http.client_body; content:"username="; classtype:web-application-attack; sid:20373849; rev:1;)

This rule flags any inbound POST request to install.php carrying the action=reinstall parameter along with the installer payload fields. Organizations should tune the rule to their legitimate administrative workflows; any match from an external source IP should be treated as a probable intrusion attempt.

Elastic Detection

any where
  event.category == "web" and
  http.request.method == "POST" and
  url.path endsWith "/install.php" and
  (url.query contains "action=reinstall" or
   url.query contains "dbuser=" or
   url.query contains "dbpasswd=")

This EQL query searches web traffic telemetry indexed in Elasticsearch (e.g., from Filebeat/APM or a WAF) and flags POST requests to the Emlog installer that contain the reinstall action or database credential parameters. For environments that capture HTTP request bodies, the additional fields request.body.content should be inspected for dbuser, dbpasswd, dbprefix, and action=reinstall to catch parameters that may appear in the body rather than the query string.

Splunk SPL Query

index=web sourcetype=access_combined
  method=POST uri_path="*/install.php"
  (uri_query="*action=reinstall*" OR uri_query="*dbuser=*" OR uri_query="*dbpasswd=*" OR uri_query="*dbprefix=*")
| eval indicator=case(
    match(uri_query, "(?i)action=reinstall"),"reinstall-action",
    match(uri_query, "(?i)dbuser="),"db-credential-injection",
    true(),"installer-field")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, uri_query, status, indicator, user_agent
| sort - count

For deployments logging full HTTP request bodies, the following additional query can detect the exploit payload directly:

index=proxy OR index=waf
  (form_data="*action=reinstall*" OR form_data="*hostname=*" AND form_data="*dbuser=*" AND form_data="*dbpasswd=*")
| table _time, src_ip, url, http_method, form_data, dest_host
| sort -_time

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100738" level="12">
    <decoded_as>web</decoded_as>
    <field name="method">POST</field>
    <field name="url">\.php</field>
    <match>install\.php</match>
    <regex>action=reinstall</regex>
    <description>CVE-2026-73849: Emlog install.php unauthenticated reinstall attempt detected</description>
    <group>web_application_attack,pci_dss_6.5,gpg13_7.6,</group>
  </rule>

  <rule id="100739" level="10">
    <if_sid>100738</if_sid>
    <regex>dbuser=|dbpasswd=|dbprefix=|hostname=</regex>
    <description>CVE-2026-73849: Emlog reinstall payload includes database overwrite parameters</description>
    <group>web_application_attack,</group>
  </rule>
</group>

The first rule generates a high-severity alert (level 12) on any web request to install.php containing action=reinstall. The second rule (level 10) fires when the request also carries the database-overwrite fields, indicating a complete exploit attempt rather than a mere probe. Wazuh decoders for Apache/Nginx access logs should be enabled so that the method, url, and regex fields are populated correctly.

Mitigation & Patch Guidance

Patch confidence for this CVE is 0/4 — no patch evidence exists from any tracked source, and the vendor has published no fixed version as of this review. The following actions should be taken immediately, in order of priority:

1. Immediate mitigations (no vendor fix required):

   • Block or restrict access to install.php at the web server level (Apache, Nginx, IIS). A rewrite rule or location block should return 403 for any request to /install.php except from a pre-approved administrative IP range.
   • If the site has already completed its initial installation, delete or rename install.php from the web root entirely. This is the single most effective control because the vulnerable endpoint no longer exists.
   • Deploy a WAF rule that inspects the query string and request body for action=reinstall combined with dbuser, dbpasswd, hostname, and username, and blocks matching requests. The Sigma, Suricata, and Splunk content in this report can be adapted for this purpose.
   • Apply file-system protections to config.php: set permissions to read-only (e.g., chmod 444) and, where supported, set the immutable attribute (chattr +i config.php) to prevent overwriting even if the installer is reached.
   • Audit existing administrator accounts immediately; look for recently created accounts with usernames matching the payload parameter pattern or unknown email addresses.

2. Patch/upgrade steps:

   • Monitor the Emlog vendor's official release channel and the CVE page at NVD for an updated version. Once a fixed release is published, upgrade all affected instances promptly.
   • Until a patched version exists, treat every Emlog deployment as actively at risk and apply the compensating controls above. There is currently no fixed version that can be recommended for upgrade.

3. Long-term hardening:

   • Integrate the detection rules in this report into SIEM, IDS, and EDR alerting pipelines so that any future attempt to reach install.php is flagged and investigated.
   • Add a configuration-management policy that verifies install.php is absent from production web roots on a recurring basis.
   • Adopt least-privilege for the database account used by the CMS so that even a compromised configuration cannot access unrelated databases.
   • Regularly review CMS user lists and audit logs for unexpected administrative accounts, and enforce strong, unique passwords for all CMS accounts.
   • Maintain a vulnerability-management process for open-source CMS dependencies; CWE-306 flaws in installer scripts are frequently reintroduced in subsequent releases, so regression testing of the installer path should be part of the release lifecycle.

References

• NVD Entry for CVE-2026-73849: https://nvd.nist.gov/vuln/detail/CVE-2026-73849
• CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• Emlog Official Project Site: https://www.emlog.net
• ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No CISA KEV listing exists for CVE-2026-73849 as of this review, and no publicly documented threat-actor campaigns or confirmed exploit-in-the-wild activity have been identified. The absence of such evidence should not be treated as reassurance given the trivial exploitation mechanics and the Critical CVSS score of 9.8; organizations running Emlog 2.6.26 or earlier should apply the compensating controls in the Mitigation section immediately.