PT-2025-21361 · Emlog · Emlog

Heguangyu5

·

CVE-2025-47784

·

Published

2025-05-15

·

Updated

2025-10-20

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Emlog versions 2.5.13 and earlier
Description: Emlog is an open source website building system. The system has a deserialization issue. A user can create a carefully crafted nickname, causing str replace to replace the value of name orig with an empty value. This results in deserialization failing and returning false.
Recommendations: For Emlog versions 2.5.13 and earlier, update to a version that includes the fix from commit 9643250802188b791419e3c2188577073256a8a2 to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-47784
GHSA-F56G-M99V-MQC3

Affected Products

Emlog