Vulnerability · Published Oct 6, 2025 · Assigned by GitHub_M

CVE-2025-61769Emlog vulnerable to stored XSS in file upload functionality in emlog

Low 2.1

In plain English

A low-severity cross-site scripting in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= 2.5.22

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References

https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf x_refsource_CONFIRM
https://github.com/emlog/emlog/commit/052f9c4226b2c0014bcd857fec47677340b185b1 x_refsource_MISC