PT-2025-40911 · Emlog · Emlog

Huu1J · Published 2025-10-06 · Updated 2025-10-09 · CVE-2025-61769

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Emlog versions up to and including 2.5.22

Description A cross-site scripting (XSS) issue exists in Emlog, potentially allowing authenticated remote attackers to inject arbitrary web script or HTML. This is possible through the file upload functionality, specifically by uploading malicious .svg files containing JavaScript code which is then executed. The issue is addressed by commit 052f9c4226b2c0014bcd857fec47677340b185b1.

Recommendations Update to a version later than 2.5.22.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61769

GHSA-RRF5-PV68-GPJF

Affected Products

Emlog

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61769.json · Exploit
• 🔥 https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf · Exploit
• https://github.com/emlog/emlog/commit/052f9c4226b2c0014bcd857fec47677340b185b1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-61769 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61769 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1975296607584170340 · Twitter Post
• https://t.me/cveNotify/138011 · Telegram Post
• https://t.me/CVEtracker/34262 · Telegram Post
• https://twitter.com/CVEnew/status/1975234266696233432 · Twitter Post