CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data
Attackers can cause denial of service in Emlog by crafting a nickname that breaks deserialization logic, requiring a patch to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-47784?
CVE-2025-47784 is a medium-severity unsafe deserialization vulnerability in Emlog Emlog, published on 15 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue.
Weakness: CWE-502
Which versions are affected by CVE-2025-47784?
It affects 1 product.
Products include Emlog Emlog.
How do I fix CVE-2025-47784?
No fix has been published for CVE-2025-47784 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-47784 being exploited?
There is no known exploitation of CVE-2025-47784 in the wild and no public exploit code.
Other vulnerabilities in Emlog Emlog
Sources
Also known as GHSA-f56g-m99v-mqc3.