{"id":"CVE-2025-61318","title":"Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability","summary":"Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for del…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-24"],"vendor":"emlog","product":"emlog","affected":["emlog = 2.5.20"],"published":"2025-12-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:10:00.173","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61318","references":[{"url":"https://github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vuln.md","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00728,"epssPercentile":0.53155,"ingestedAt":"2026-10-15T19:25:46.337Z","slug":"CVE-2025-61318","body":"## Overview\n\nEmlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.\n\n## Affected\n\n- `emlog = 2.5.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}