CVE-2025-26014

The vulnerability results from insufficient validation of the path parameter passed to the application, which corresponds to the CWE-94 category (code injection). An attacker can craft an appropriate network request by injecting malicious code through this parameter. The lack of authentication and low attack complexity make it possible for any person with network access to the service to execute the exploit.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the application process, which may lead to complete server takeover, data theft, backdoor installation, or further lateral movement in the network.

Apply patches available from the vendor according to references. It is recommended to monitor the vendor's repositories (Gitee/GitHub) at https://gitee.com/olajowon/loggrove/ for information about available updates. Until the patch is implemented, consider restricting access to the service only to trusted IP addresses using a firewall.

Loggrove v.1.0 (vendor: Olajowon)