An authenticated attacker can exploit an unrestricted file upload vulnerability in ELOG to execute malicious scripts and compromise user credentials.

This flaw involves an unrestricted file upload mechanism that allows authenticated users to upload arbitrary HTML files. When opened by other users, the injected HTML executes in their browser context, potentially exposing sensitive data, including password hashes, to the attacker.

The exploitation of this vulnerability poses a significant risk to organizational security, as it facilitates unauthorized access to sensitive user credentials and potential session hijacking. Given the CVSS score of 8.0, this issue is classified as High severity because it allows for the exfiltration of authentication material, which could lead to full account takeover and lateral movement within the ELOG environment.

Immediate Action: Update the ELOG software to version 3.1.5-20251014 or later, which enforces the rendering of HTML files as plain text to prevent script execution.

Proactive Monitoring: Review web server and application access logs for unusual file upload activity or patterns involving HTML file extensions by non-administrative users.

Compensating Controls: Implement strict file upload validation policies at the Web Application Firewall (WAF) level to block or sanitize content containing HTML tags or scripts from untrusted users.

Public Exploit Available: No

Organizations utilizing ELOG must prioritize the deployment of the 3.1.5-20251014 update to neutralize this critical vector for credential harvesting. Because this vulnerability allows an authenticated attacker to compromise other users, immediate remediation is essential to maintain the integrity and confidentiality of the platform.