Emlog Pro up to 2.5.18 media.php?action=upload&sid=0 File unrestricted upload 🚫 [False Positive]

Noticeinfo

⚠️ This issue appears to be a false-positive. Please verify the sources mentioned and consider not using this entry at all. The vendor was contacted early about this disclosure but did not respond in any way. The file upload in include/service/media.php verifies the file extension based on a list defined in include/lib/option.php. This whitelist prevents unrestricted uploads (e.g. PHP files). Therefore, the attack possibility is just of theoretical nature.

Productinfo

Name

• Emlog Pro

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18

Timelineinfo

08/20/2025 Advisory disclosed
08/20/2025 +0 days VulDB entry created
01/08/2026 +141 days VulDB entry last update

Sourcesinfo

Advisory: github.com
False Positive: Yes

CVE: CVE-2025-9173 (🔒)
GCVE (CVE): GCVE-0-2025-9173
GCVE (VulDB): GCVE-100-320765
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔒

Entryinfo

Created: 08/20/2025 12:53
Updated: 01/08/2026 09:30
Changes: 08/20/2025 12:53 (55), 09/12/2025 16:28 (41), 01/08/2026 09:30 (3)
Complete: 🔍
Submitter: l1nk
Cache ID: 216::103

Submitinfo

Accepted

• Submit #631098: emlog.net Emlog 2.5.18 Unrestricted Upload (by l1nk)

Duplicate

• Submit #XXXXXX: Xxxxx.xxx Xxxxx X.x.xx Xxxxxxxxxxxx Xxxxxx (by l1nk)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion

Do you want to use VulDB in your project?

Use the official API to access entries easily!