Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HEmlog
APPEmlog2.5.20
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
Related vulnerabilities
CVE-2026-22799CRITICAL9.3PL ✓ten sam produkt
Emlog: nieautoryzowany upload pliku PHP przez REST API — RCE
CVE-2025-29401CRITICAL9.8PL ✓ten sam produkt
RCE przez dowolne przesyłanie plików w Emlog Pro 2.5.7
CVE-2025-25783CRITICAL9.8PL ✓ten sam produkt
Emlog Pro – dowolne przesyłanie plików umożliwiające RCE (admin/plugin.php)
CVE-2023-44974CRITICAL9.8ten sam produkt
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers...
CVE-2023-44973CRITICAL9.8ten sam produkt
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attacke...