CVE-2025-61769CWE-79cross-site-scripting

CVE-2025-61769

Medium · published October 6, 2025

CVSS v3.1

6.1

EPSS

Percentile

19.6

In the wild

Unconfirmed

What it is

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00282 · 19.6th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-10-06T21:16Z

Affected products (1)

Product	Versions	Fixed in
emlog/emlog	< 2.5.22	2.5.22

References (3)

https://github.com/emlog/emlog/commit/052f9c4226b2c0014bcd857fec47677340b185b1 · [email protected]https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf · [email protected]https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

06 OCT 16:09Z
Emlog vulnerable to stored XSS in file upload functionality in emlog
cvelistv5