CVE-2026-67598
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification.
Risk Assessment
Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including query_database and update_config tool handlers, potentially leading to data leakage or unauthorized configuration changes.
Recommendation
Upgrade to a version that re-enables TLS certificate validation, or manually enable verification in the source code.
Other vulnerabilities in Emlog Pro
See all- CVE-2025-61318Critical
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. It stems from the admin/template.php and admin/plugin.php components, which fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
- CVE-2025-25783Critical
An arbitrary file upload vulnerability was found in Emlog Pro version 2.5.3 within the admin\plugin.php component. It allows an attacker to execute arbitrary code by uploading a crafted ZIP file.
- CVE-2026-39276High
The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.
- CVE-2025-44139High
Emlog Pro V2.5.7 is vulnerable to unrestricted file upload of dangerous types via the /emlog/admin/plugin.php?action=upload_zip endpoint. An attacker can upload a malicious ZIP file that gets extracted and executed on the server.
- CVE-2025-25827Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in the sort.php component of Emlog Pro v2.5.4. It allows an attacker to scan local and internal ports by supplying a crafted URL.
- CVE-2025-25825High
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious scripts or HTML via the title field in the article category section.
- CVE-2025-25823High
A cross-site scripting (XSS) vulnerability was found in Emlog Pro version 2.5.4. It allows an attacker to inject malicious JavaScript or HTML code into the article header via the admin panel at /admin/article.php.
- CVE-2025-25818Medium
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious JavaScript or HTML via the postStrVar function in article_save.php.
Original NVD description (English source)
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.