CVE-2025-61769

Emlog vulnerable to stored XSS in file upload functionality in emlog

Low2.1EPSS 0.28%

Published: 6 Oct 2025
Updated: 6 Oct 2025
Reserved: 30 Sept 2025
Assigned by: GitHub_M

Description

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.

Scores

CVSS scores of CVE-2025-61769, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
NVDNVD · Analyzed	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.28% · top 79% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

emlog · emlog
- affected <= 2.5.22

References (2)

https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf (opens in a new tab)x_refsource_CONFIRMexploit
https://github.com/emlog/emlog/commit/052f9c4226b2c0014bcd857fec47677340b185b1 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-61769](https://trackcve.app/badge/CVE-2025-61769.svg)](https://trackcve.app/cve/CVE-2025-61769)

Record last updated 6 Oct 2025, 17:16 UTC.