Emlog CVE-2025-61769

Requires an authenticated account with access to Emlog's file upload functionality in version 2.5.22 or earlier (CPE indicates the 'pro' edition); prior to the fix, 'svg' was an accepted admin attachment type, so an uploaded .svg containing JavaScript is stored and served. Exploitation is further limited by required victim interaction (UI:P): the injected script runs only when a user/administrator opens or renders the malicious SVG. Limiting factors: valid authentication, a vulnerable unpatched version (pre-commit 052f9c4), and a victim viewing the file - it is not a zero-click or unauthenticated attack despite the PR:N in the supplied vector.

This is a low-priority issue, not a widespread emergency. The vendor CVSS 4.0 base score is only 2.1, consistent with a stored XSS whose impact is limited to the victim's browser context (VC:N/VI:N/VA:N but SC:L/SI:L on the subsequent system). EPSS is 0.28% (19th percentile), indicating very low predicted exploitation probability, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only publicly available exploit code exists. A key signal conflict must be flagged: the provided CVSS 4.0 vector contains PR:N (no privileges), yet the description explicitly states the flaw is reachable only by 'authenticated remote attackers' who can use the file upload functionality - these disagree, and PR:N appears to understate the real precondition; treat authentication as required and verify PR with the vendor/GHSA advisory. Exploitation also requires victim interaction (UI:P) to open/render the malicious SVG. Combined with the product's small real-world footprint, this is a genuine-but-minor finding suitable for routine patching, not emergency response.

An attacker who already holds an authenticated account on an Emlog (Pro, ≤2.5.22) site uploads a crafted .svg file containing embedded JavaScript through the normal file upload feature. When an administrator or another user later opens or renders that SVG, the script executes in their browser session, enabling session/cookie theft or admin-panel actions. Publicly available exploit code exists, but there is no confirmed active exploitation.