ELOG contains a vulnerability that allows authenticated users to upload arbitrary HTML files. These files are executed in the context of other users, potentially exposing usernames and password hashes included in certain HTTP requests. This exposure enables attackers to obtain credentials and either replay them or perform offline password cracking. The issue is addressed in ELOG version 3.1.5-20251014, where HTML files are rendered as plain text to prevent execution.