Arbitrary File Upload Vulnerability in ELOG by Ritt

CVE-2025-62618

What is CVE-2025-62618?

The ELOG application allows authenticated users to upload arbitrary HTML files, which are executed in the context of other users upon file access. This poses a serious security risk as it can enable attackers to capture sensitive information, such as usernames and password hashes, present in HTTP requests. Through this exploitation, attackers can either replay the credentials or crack the password hashes offline, thereby compromising user accounts and system integrity. The issue is particularly notable in version 3.1.5-20251014, where HTML files are improperly rendered, escalating the vulnerability's impact.

References