CVE-2025-26014

CriticalPublic PoCRCE

Published: 21 February 2025

Published

21 February 2025

Modified

13 June 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0193 83.5th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26014 is a critical-severity Code Injection (CWE-94) vulnerability in Olajowon Loggrove. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents code injection RCE by requiring validation of path parameters to ensure they conform to safe, expected formats.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation for the specific RCE vulnerability in Loggrove v1.0, eliminating the exploitable code injection issue.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Facilitates early detection of the CVE-2025-26014 vulnerability through regular scanning and monitoring, enabling patching before remote exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct RCE via code injection (CWE-94) on a public-facing application, matching T1190 exactly with network-exploitable unauthenticated access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.

Deeper analysisAI

CVE-2025-26014, published on 2025-02-21, is a remote code execution (RCE) vulnerability in Loggrove version 1.0. The flaw allows a remote attacker to execute arbitrary code by exploiting the path parameter. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-94 (code injection).

The vulnerability enables exploitation over the network with low complexity, requiring no authentication, privileges, or user interaction, while maintaining an unchanged impact scope. A remote attacker can achieve high-impact compromise, including unauthorized access to confidential data, modification of system integrity, and disruption of availability through arbitrary code execution on the affected Loggrove instance.

Mitigation details and further information are referenced in the project's repositories on Gitee (https://gitee.com/olajowon/loggrove/ and https://gitee.com/olajowon/loggrove/issues/IBJT1K) and GitHub (https://github.com/olajowon/loggrove/).