CVE-2025-26014
Published: 21 February 2025
Summary
CVE-2025-26014 is a critical-severity Code Injection (CWE-94) vulnerability in Olajowon Loggrove. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26014 is a remote code execution vulnerability in Loggrove version 1.0 that stems from improper control of code generation, tracked as CWE-94. The flaw resides in handling of the path parameter and received a CVSS 3.1 base score of 9.8, reflecting network attackability with no required privileges or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply a crafted path value to execute arbitrary code on the server, achieving complete system compromise. The attack requires only network access and succeeds against any exposed instance of the affected version.
The listed references consist of the project repository and an issue report but contain no explicit patch or mitigation instructions. The associated EPSS probability reached a peak of 0.0193.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4492
Vulnerability details
A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via code injection (CWE-94) on a public-facing application, matching T1190 exactly with network-exploitable unauthenticated access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents code injection RCE by requiring validation of path parameters to ensure they conform to safe, expected formats.
Mandates timely flaw remediation for the specific RCE vulnerability in Loggrove v1.0, eliminating the exploitable code injection issue.
Facilitates early detection of the CVE-2025-26014 vulnerability through regular scanning and monitoring, enabling patching before remote exploitation.