CVE-2025-47787 is a critical file upload flaw (CVSS 9.8) in Emlog Pro. The plugin store component does not check the contents of ZIP files it downloads, which can lead to code execution. Versions through 2.5.9 are affected, and 2.5.10 contains the fix.
What's affected
The GitHub advisory lists Emlog Pro 2.5.9 and earlier as affected and 2.5.10 as the patched version. The record words it as versions before 2.5.10. The vulnerable component is store.php in the admin area, which installs plugins from a remote source.
The advisory says the impact is full server takeover. The record's vector shows no privileges required, while the advisory's walk through uses a logged in administrator session. I cannot tell from these sources which is right in every setup, so assume the worst and patch.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check your Emlog Pro version in the admin panel and compare it with 2.5.9. Anything at or below that is affected.
Then look at your plugin directory for folders you did not install. Plugins live under the content directory of your install. A folder with an unfamiliar name, or one that was created at a time when nobody on your team installed anything, deserves a close look.
Also review your web server access logs for requests to the plugin install action in the admin area, and compare them with times your team actually installed plugins.
What to do now
- Upgrade Emlog Pro to 2.5.10 or later.
- List the plugins in your content directory and remove any you do not recognize.
- Review logs for plugin install requests that you cannot match to a change.
- Restrict the admin area by IP address or VPN where you can.
- Rotate administrator passwords and any keys stored in your configuration if you suspect misuse.
- Take a clean backup after you finish and keep the old one for comparison.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-434, unrestricted upload of a file with a dangerous type. The plugin store downloads a ZIP archive from a source and unpacks it into the plugins folder. If the contents are not checked, an archive can carry a script that the web server will later run as code.
The lesson is to treat anything downloaded as untrusted, even from a plugin store. Defenses include allowing only known sources, verifying signatures or hashes, checking file types after extraction and making the plugin directory unable to run scripts. Version 2.5.10 is the fix, and the other steps reduce the chance of a similar flaw doing damage later.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Emlog Pro version fixes CVE-2025-47787?
The advisory lists 2.5.10 as the patched version.
Does an attacker need to be logged in?
The record's vector says no privileges, but the advisory's walk through uses an administrator session. Treat it as serious either way.
Sources
Last reviewed: 18 October 2026.
