CVE-2025-25783

The vulnerability mechanism is based on the lack of proper validation of uploaded files (CWE-434 – Unrestricted Upload of File with Dangerous Type). The attacker uploads a crafted Zip file to the plugin handling component (admin\plugin.php). On the server side, the file is extracted and processed without verification of its contents, which allows placement of a malicious executable file (e.g., webshell) in the application's accessible directory. As a result, the attacker can invoke this file and execute arbitrary system commands.

An attacker can gain full control over the server – execute arbitrary code (RCE), access confidential data, modify application content, or use the server as a launching point for further attacks on the internal network.

Apply patches available from the vendor according to the references (https://www.emlog.net/). Until the update is applied, it is recommended to restrict access to the administrative panel exclusively to trusted IP addresses and monitor the plugins directory for unauthorized files.

Emlog Pro v2.5.3