The vulnerability occurs when a user publishes an article using the Resource media library feature. The image name field is not properly sanitized, allowing an attacker to embed malicious JavaScript that is stored and later rendered in the article page. This leads to client‑side code execution in the browsers of anyone who views the affected article, potentially resulting in session hijacking, defacement, or phishing attempts. The weakness matches CWE‑79, a classic stored cross‑site scripting flaw.

The affected product is emlog version 2.5.23, an open‑source website building system. No other versions or vendors are cited as affected and no patched releases are listed as available at the time of this advisory.

The CVSS base score is 2, indicating low severity, and the EPSS is below 1%, meaning exploitation is considered rare. The vulnerability is not in the CISA KEV catalog, and no public exploits are currently known. The likely attack vector involves a legitimate article publisher submitting a crafted image name via the web interface, which the server stores and later serves to visitors. Because the flaw is stored XSS and not remote code execution on the server, the attack requires the victim to view the compromised article and is therefore client‑side and user‑dependent.