CVE-2025-61318

Critical

Published: 08/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. It stems from the admin/template.php and admin/plugin.php components, which fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.

Risk Assessment

An attacker can delete arbitrary files on the server, potentially leading to data loss or disruption of the application.

Recommendation

Update Emlog Pro to the latest version if a patch is available. Additionally, restrict access to the admin panel and implement path validation in the code.

Original NVD description (English source)

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.