# CVE-2025-61318: Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php…

Source: https://junglewise.ai/threats/cve-2025-61318-emlog-pro-2-5-20-has-an-arbitrary-file-deletion-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-08  
License: CC BY 4.0 with a link back

CVE-2025-61318 · Severity: critical · CVSS 9.1 · Published 2025-12-08

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.

Technologies: [Emlog](https://junglewise.ai/threats/technologies/emlog). Vendors: [Emlog](https://junglewise.ai/threats/vendors/emlog).

## Quick answers

**Is CVE-2025-61318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61318 being exploited in the wild.

**How severe is CVE-2025-61318?** Critical severity, with a CVSS score of 9.1, published 8 December 2025.

**Which products and versions are affected?** Emlog. The advisory does not name versions.

**Is there a fix for CVE-2025-61318?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-61318?** Check whether you run Emlog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Emlog

## Related threats

- [Emlog stored XSS in tag names via article editor](https://junglewise.ai/threats/cve-2026-73848-emlog-stored-xss-in-tag-names-via-article-editor)
- [Emlog stored XSS in Markdown article rendering](https://junglewise.ai/threats/cve-2026-53758-emlog-stored-xss-in-markdown-article-rendering)
- [Emlog path traversal in ZIP extraction enables RCE](https://junglewise.ai/threats/cve-2026-53757-emlog-path-traversal-in-zip-extraction-enables-rce)
- [Emlog SQL injection in queryDatabase function](https://junglewise.ai/threats/cve-2026-73850-emlog-sql-injection-in-querydatabase-function)
- [Emlog unauthenticated installation in install.php](https://junglewise.ai/threats/cve-2026-73849-emlog-unauthenticated-installation-in-install-php)