CVE-2019-16868

CRITICAL

emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traversal sequences in the bak[] parameter.

Published: Sep 25, 2019 Modified: Jun 17, 2026

CWE-22

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (2)

Vendor	Product	Version
emlog	emlog	*
emlog	emlog	6.0.0

GitHub Security Advisory GHSA-gjqc-j2jf-4gcm

emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action...

References (2)

https://github.com/emlog/emlog/issues/48 Exploit, Third Party Advisory
https://github.com/emlog/emlog/issues/48 Exploit, Third Party Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 2.56%

Top 16% most likely to be exploited

Threat Score 40 / 100

Data Sources

NVD EPSS GitHub