PT-2025-21367 · Emlog Pro · Emlog Pro

Y4Y17 · Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-47787

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Emlog Pro versions prior to 2.5.10

Description: The issue is related to a file upload vulnerability in the store.php component, which fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system.

Recommendations: For versions prior to 2.5.10, update to version 2.5.10 to resolve the issue. As a temporary workaround, consider disabling the store.php component until the patch is applied. Restrict access to the ZIP plugin files to minimize the risk of exploitation. Avoid using the store.php component for remote downloads until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-47787

GHSA-4MCJ-8GVH-P753

Affected Products

Emlog Pro

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47787.json · Exploit
• 🔥 https://github.com/emlog/emlog/security/advisories/GHSA-4mcj-8gvh-p753 · Exploit
• https://github.com/emlog/emlog/commit/691c13e90df2fb35e120f4e0735078bad018eed7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-47787 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47787 · Vendor Advisory
• https://t.me/cvetracker/23942 · Telegram Post
• https://twitter.com/CveFindCom/status/1923099301166698945 · Twitter Post
• https://twitter.com/CVEnew/status/1923100396651937863 · Twitter Post