CVE-2026-73849

creationtimestamp| type| source ---|---|--- 2026-08-14 18:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt2t6zaamo2p 2026-08-14 19:10:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/d3fnour6j45st...

CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...