CVE-2026-73849

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27

Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable is not equal to reinstall. A remote attacker can provide values for hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email to trigger the file put contents() function. This allows the attacker to overwrite the config.php file with malicious database settings and create a new administrator account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.