CVE-2025-61318
Published: 08 December 2025
Summary
CVE-2025-61318 is a critical-severity Path Traversal: '../filedir' (CWE-24) vulnerability in Emlog Emlog. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked in the top 24.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates validation of untrusted inputs like deletion parameters to prevent directory traversal and arbitrary file deletion in admin/template.php and admin/plugin.php.
Requires timely remediation of flaws such as the missing path verification, directly addressing the vulnerability through patching.
Enforces approved authorizations for file operations, mitigating unauthorized deletions via traversal beyond intended admin directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file deletion via directory traversal in admin components enables indicator removal through file deletion (T1070.004) and file deletion for disruptive impact (T1107).
NVD Description
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for…
more
directory traversal.
Deeper analysisAI
CVE-2025-61318 is an arbitrary file deletion vulnerability affecting Emlog Pro version 2.5.20. The issue arises in the admin/template.php and admin/plugin.php components, which fail to perform proper path verification and dangerous code filtering on deletion parameters. This flaw enables directory traversal attacks. It has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and is associated with CWE-24 (Path Traversal) and NVD-CWE-Other.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By manipulating deletion parameters, they can traverse directories and delete arbitrary files on the server, resulting in high integrity and availability impacts but no confidentiality loss.
The primary advisory reference is available at https://github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vuln.md, which provides further technical details on the vulnerability. No specific patch or mitigation guidance is detailed in the provided CVE information.
Details
- CWE(s)