Volerion logoVolerion
Volerion logoVolerion

Emlog Cross-Site Scripting Vulnerability in File Upload Functionality

Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Emlog versions through pro-2.5.17. This issue allows authenticated remote attackers to inject arbitrary web scripts or HTML via the file upload feature. Exploitation involves uploading an .svg file containing JavaScript code, which is subsequently executed. As of now, no patched versions are available.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, an authenticated user can upload an .svg file through the file upload functionality in the admin panel. The uploaded .svg file can contain JavaScript code, such as a script tag with a JavaScript alert. After uploading the file, visiting the URL of the uploaded file will execute the injected JavaScript code.

Added: Jul 16, 2025, 6:25 PM
Updated: Jul 16, 2025, 6:25 PM

Vulnerability Rating

Custom Algorithm
spread
1.0
impact
1.7
exploitability
6.5
remediation
0.0
relevance
0.2
threat
6.4
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.