CVE-2026-67598

Name of the Vulnerable Software and Affected Versions Emlog Pro versions prior to 2.6.24

Description In the file include/service/ai.php, TLS certificate validation is disabled, allowing network-adjacent attackers to intercept outbound HTTPS requests to configured Large Language Model (LLM) providers by presenting arbitrary TLS certificates. This occurs because CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST are unconditionally disabled within the sendStream(), sendImageRequest(), send(), and fetchSearchHtml() functions. Attackers can execute a man-in-the-middle attack to extract Authorization Bearer API keys from AI requests and inject malicious AI responses. These responses may be processed by the tool-call execution pipeline, specifically affecting the query database and update config tool handlers.

Recommendations Update Emlog Pro to version 2.6.24 or later. As a temporary mitigation, restrict network access to the include/service/ai.php component to prevent unauthorized interception of outbound requests.