CVE-2025-62618: ELOG file upload stored XSS
ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ELOGto a version that resolves this vulnerability.Fixed in 3.1.5-20251014
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62618?
CVE-2025-62618 has a medium severity rating due to its potential for credential theft.
How do I fix CVE-2025-62618?
To fix CVE-2025-62618, ensure proper validation of uploaded files and restrict file types to prevent arbitrary HTML uploads.
Who is affected by CVE-2025-62618?
CVE-2025-62618 affects any authenticated user of the ELOG software who can upload files.
What type of vulnerability is CVE-2025-62618?
CVE-2025-62618 is a file upload vulnerability that allows execution of arbitrary HTML content.
What are the consequences of CVE-2025-62618?
The consequences of CVE-2025-62618 include potential exposure of usernames and password hashes to attackers.