CVE-2025-47787

Emlog Pro Contains a File Upload Vulnerability

CVSS 8.9 HIGHEPSS 0.6%CWE-434

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.9EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

15 May 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

emlog · emlog

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/emlog/emlog/commit/691c13e90df2fb35e120f4e0735078bad018eed7 https://github.com/emlog/emlog/security/advisories/GHSA-4mcj-8gvh-p753