CVE-2025-47787
Critical
Description
Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEmlog
PublishedMay 15, 2025
First seenMay 15, 2025
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- emlog emlog2.5.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emlog emlog | v < 2.5.10 | 2.5.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.