PT-2025-11709 · Emlog Pro · Emlog Pro

Published 2025-03-19 · Updated 2025-06-12 · CVE-2025-29405

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions emlog pro versions 2.5.0 through 2.5.*

Description An arbitrary file upload vulnerability in the component /admin/template.php allows attackers to execute arbitrary code via uploading a crafted PHP file. The vulnerability is exploited through the "/admin/template.php" API endpoint, where an attacker can upload a malicious PHP file, potentially leading to code execution.

Recommendations For emlog pro versions 2.5.0 through 2.5.*, consider disabling the /admin/template.php component until a patch is available to prevent arbitrary file uploads. Restrict access to this component to minimize the risk of exploitation. Avoid using this component for uploading files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-29405

Affected Products

Emlog Pro

References · 8

• 🔥 https://github.com/bGl1o/emlogpro/blob/main/emlog%20pro2.5.7-getshell-2.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29405 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29405 · Vendor Advisory
• https://t.me/cvenotify/125542 · Telegram Post
• https://gist.github.com/bGl1o/19a141ee6e899884fa85f3a52898bcc6 · Note
• https://t.me/cvedetector/20658 · Telegram Post
• https://t.me/cvetracker/19464 · Telegram Post
• https://twitter.com/CVEnew/status/1902417444892995978 · Twitter Post