Description
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
Affected products
emlog: emlog
References1
- github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vuln.md ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - EPSS — exploit probability
- 1% percentile: 56 · as of 11 November 2026
- CWE
- CWE-24
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.