A stored cross-site scripting vulnerability in Emlog versions 2.5.21 and below allows authenticated administrators to be compromised via malicious HTML template injection.

This vulnerability is a stored cross-site scripting (XSS) flaw triggered by improper neutralization of input within the mail template settings. An attacker with administrative access can inject malicious JavaScript that executes when the settings page is viewed, leading to session hijacking or full account takeover.

The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the Emlog platform. With a CVSS score of 7.6, this high-severity flaw enables an attacker to gain administrative control over the application, potentially resulting in unauthorized data access, system configuration changes, or the deployment of further malicious content across the site.

Immediate Action: Update Emlog to version 2.5.22 or later immediately to incorporate the security patch provided by the vendor.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes to mail template configurations within the application settings.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns.

Public Exploit Available: No confirmed public exploit available.

Given the potential for complete administrative account compromise, organizations running Emlog must prioritize the upgrade to version 2.5.22. Applying this update is the only effective way to neutralize the XSS vector and secure the administrative interface against unauthorized session theft.