CVE-2025-61318

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-08 · updated 2026-10-15
Weakness: CWE-24

Description

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.

Affected products

emlog: 2.5.20

References

https://github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vuln.md

Get alerted when CVE-2025-61318 or the next vulnerability affects your stack