Emlog, an open‑source website builder, is susceptible to Server‑Side Request Forgery via uploaded SVG files. A crafted SVG containing external resource references can be uploaded to the admin/media.php endpoint. When the server processes, thumbnails the preview, or sanitizes the file, it automatically requests the external resource, enabling the attacker to force the server to perform HTTP requests to arbitrary hosts. This flaw, classified as CWE‑918, can allow an attacker to probe internal network resources and potentially glean sensitive data or credentials from exposed metadata. The vulnerability exists in all releases up to and including version 2.5.19.

The affected product is Emlog by Emlog, with all released versions up to and including 2.5.19. No patched versions are reported in the advisory, and the vulnerability remains present in these releases.

The CVSS v3.1 score of 7.7 indicates a high severity for remote exploitation, while the EPSS score of less than 1% suggests that active exploitation is presently rare. The vulnerability is not listed in the CISA KEV catalog, but an attacker who can upload an SVG file to the admin/media.php endpoint can trigger the SSRF. Successful exploitation would allow internal network reconnaissance and may expose internal metadata or credentials. Given the lack of an available patch, the risk to organizations running affected Emlog installations remains significant, especially if the upload functionality is exposed to untrusted users.