CVE-2025-29401

The /views/plugin.php component does not properly validate the type or content of uploaded files. An attacker can upload a crafted PHP file (such as a webshell or payload) which will be saved on the server. After upload, the file can be executed via a browser or other HTTP request, resulting in arbitrary code execution on the server side.

An attacker can gain full control over the server — read, modify or delete data, as well as execute arbitrary system commands (RCE). This can lead to a complete breach of the system's confidentiality, integrity, and availability.

Patches available from the vendor should be applied according to the references. Until updates are deployed, it is recommended to restrict access to the /views/plugin.php component at the firewall or web server level and monitor uploaded files for suspicious extensions.

Emlog Pro version 2.5.7