Read the docs
TI-2026-44079 Aliases CVE-2026-61498GHSA-h22f-f7h4-9589

Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php

Priority HIGH 81CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04008 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VITECFlamingo4.12.2 and later—No fix listedCNA
  • Flamingo VendorVITEC Affected 4.12.2 and later Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:*up to 4.12.2VulnerableVITEC
  • cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:* Versions up to 4.12.2 Vulnerable ·VITEC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61498
  2. 2026-10-03 Alias added: GHSA-h22f-f7h4-9589

References

Exploit 1

Other 1

  • TI-2026-42838 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences