CVE-2025-61318 is a critical (CVSS 9.1) arbitrary file deletion flaw in Emlog Pro 2.5.20. The admin template and plugin components do not verify paths or filter dangerous input in the deletion parameters, which allows directory traversal. The record names no fixed version, so check for a newer release.
What's affected
- Product: Emlog Pro, a blog and content management system.
- Affected: version 2.5.20.
- Vulnerable components:
admin/template.phpandadmin/plugin.php, through the deletion parameters. - Weakness: CWE-24, a path traversal weakness.
- Fixed: none named in the record. Check the Emlog project for a release newer than 2.5.20.
- CVSS 3.1: 9.1, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The vector shows no privileges and no user interaction. - Impact: integrity and availability are rated high, and confidentiality none.
- Known exploited: no, the record is not on the CISA KEV list.
How to check if you're exposed
Find the Emlog version. The admin dashboard shows it in the footer or the system information page, and the install folder holds a version file:
grep -rn "EMLOG_VERSION" /var/www/html/include 2>/dev/null | head
find /var/www -name "template.php" -path "*admin*" 2>/dev/null
Adjust paths for your install. Version 2.5.20 is the one the record names.
Then check who can reach the admin area. The vulnerable files sit in the admin folder. If the admin path is open to the internet, restrict it. Look at web logs for requests to the template and plugin admin pages from unknown addresses, and confirm that your core files, themes and plugins are all still present. Missing files are a sign that deletion has occurred.
What to do now
- Find all Emlog Pro installs and confirm the version.
- Check the project website and release notes for a version newer than 2.5.20 that addresses the issue, and apply it. The record names none.
- Restrict the admin folder to trusted addresses at the web server or firewall.
- Run the web server user with write access only where the application needs it. File deletion can only remove what that account can remove.
- Take a verified backup of the site files and database now, and test restoring it.
- Monitor file integrity on the install directory so missing files raise an alert.
Why it matters
Path traversal (CWE-24) in a delete function means that a parameter meant to name a theme or plugin can be made to point at any file the web server account can remove. The record says the code did not verify the path or filter dangerous input.
The vector rates availability and integrity as high. Deleting a core file, a configuration file or the folder that holds uploads can take a site offline or reset an installation to a state where it can be taken over, depending on how the application behaves when files are missing.
The record does not say whether authentication is needed, and the vector shows none. Treat the admin area as exposed unless you have verified otherwise. The record does not claim exploitation in the wild, and it is not on the CISA KEV list. Since no fix is named, backups and restricted file permissions are your best controls.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The CVE record names no fixed version. Check the Emlog project for releases after 2.5.20.
What does the weakness let someone do?
Per the record, delete files by passing unchecked paths to the template and plugin deletion features.
Sources
- Safeguard Gold entry for CVE-2025-61318
- github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vul (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
