CVE-2025-47784 is a deserialization flaw in Emlog 2.5.13 and earlier, scored critical (CVSS 9.8) in the record. A crafted user nickname breaks cache loading. A commit fixes it, but the advisory lists no patched release, so check for a newer version.
What's affected
The record says Emlog versions 2.5.13 and prior are affected, and that a specific commit fixes the issue. The GitHub advisory lists the affected versions as 2.5.13 and below, and shows patched versions as none. In other words, the fix exists in the code, but the advisory does not name a release that contains it. Check the project's releases page for anything newer than 2.5.13.
There is a gap between the scores here that you should know about. The record scores the issue 9.8 with network access, no privileges and full impact. The GitHub advisory rates it Moderate, and its description, written in Chinese, explains the effect as follows: a registered user sets a nickname that makes the cache loader strip text it should not, deserialization then returns false, and the admin home page fails when it tries to count the result. That reads as a denial of service on the admin page. I could not confirm a broader impact, so judge by your own risk tolerance.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find your Emlog version in the admin panel footer or in the version file in your install, and compare it with 2.5.13.
Then check whether your site allows open registration. The advisory scenario starts with registering an account, so a site that lets anyone sign up is easier to target than one with closed registration.
Look at the project's releases for any build above 2.5.13, and read its notes for a mention of this fix. If you manage the code yourself, you can also check whether the commit referenced in the advisory is present in your copy.
What to do now
- Check your Emlog version and note whether it is 2.5.13 or lower.
- Look for a newer release that includes the fix commit, and upgrade if you find one.
- If no release is available, apply the commit from the advisory on a staging copy, test it, then deploy.
- Consider turning off open registration until you are patched.
- Review your user list for nicknames that look odd or contain code like markers.
- Watch the admin home page for errors that could be a sign someone has triggered the problem.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-502, deserialization of untrusted data. Emlog saves user data in a cache file and reads it back. The advisory explains that the code removes a marker string from the cached text before decoding it, and that a user nickname containing the same marker can corrupt the stored data. The result is a failed decode.
It is a useful reminder that cached data derived from user input is still untrusted. Whatever a user can type, including a nickname, can end up inside a stored structure. The advisory's proposed fix is to remove only the leading marker rather than every match anywhere in the text.
Quick check
Is there a patched release of Emlog for CVE-2025-47784?
The advisory lists no patched version. The record points to a fix commit. Check the project releases for a build newer than 2.5.13.
Why do the score and the advisory disagree?
The record scores it 9.8 and the GitHub advisory rates it Moderate. The advisory describes the visible effect as a failure on the admin home page.
Sources
Last reviewed: 18 October 2026.
