CVE-2025-61769: Emlog vulnerable to stored XSS in file upload functionality in emlog

Q: What is the severity of CVE-2025-61769?

CVE-2025-61769 has a moderate severity, allowing authenticated users to perform cross-site scripting attacks.

Q: How do I fix CVE-2025-61769?

To fix CVE-2025-61769, update Emlog to version 2.5.23 or later to mitigate the XSS vulnerability.

Q: Who is affected by CVE-2025-61769?

CVE-2025-61769 affects all Emlog installations up to and including version 2.5.22.

Q: What type of vulnerability is CVE-2025-61769?

CVE-2025-61769 is a cross-site scripting (XSS) vulnerability.

Q: Can CVE-2025-61769 be exploited remotely?

Yes, CVE-2025-61769 can be exploited by authenticated remote attackers through the file upload functionality.

Published Oct 6, 2025

Updated

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.

Affected Software

2 affected components

Emlog emlog<=2.5.22

Emlog emlog<2.5.22

Remediation

Patch Available

https://github.com/emlog/emlog/commit/052f9c4226b2c0014bcd857fec47677340b185b1

Event History

Oct 6, 2025

CVE Published

via MITRE·04:09 PM

Data Sourced

via MITRE·04:09 PM

DescriptionWeakness

Data Sourced

via NVD·05:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Feb 5, 57743

Event

via NVD·09:17 PM

Frequently Asked Questions

What is the severity of CVE-2025-61769?

CVE-2025-61769 has a moderate severity, allowing authenticated users to perform cross-site scripting attacks.

How do I fix CVE-2025-61769?

To fix CVE-2025-61769, update Emlog to version 2.5.23 or later to mitigate the XSS vulnerability.

Who is affected by CVE-2025-61769?