Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to interc…

Emlog Pro through version 2.6.23 contains a critical TLS certificate validation vulnerability in include/service/ai.php. The CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST options are unconditionally disabled across four functions: sendStream(), sendImageRequest(), send(), and fetchSearchHtml(). This allows network-adjacent attackers to perform man-in-the-middle attacks by presenting arbitrary TLS certificates to intercept outbound HTTPS requests to configured LLM providers. Attackers can extract Authorization Bearer API keys from AI requests and inject crafted AI responses into the tool-call execution pipeline. The impact is significant as injected responses may be acted upon by dangerous tool handlers including query_database and update_config. There is no option available to re-enable TLS verification, making this a systemic flaw rather than a misconfiguration.