CVE-2025-62618

ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text.

CVSS 4.0

8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-25)

CWEs

CWE-79, CWE-434, CWE-836

Published

2025-10-31

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• elog_project:elog

References

• https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946
• https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc
• https://elog.psi.ch/elog/download/RPMS/?C=M;O=D
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json
• https://www.cve.org/CVERecord?id=CVE-2025-62618

Check your stackJSON