Critical severity9.8NVD Advisory· Published Jul 13, 2026· Updated Aug 14, 2026
CVE-2026-60121
CVE-2026-60121
Description
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2=4.12.2+ 1 more
- (no CPE)range: =4.12.2
- cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:*range: <=4.12.2
Patches
Vulnerability mechanics
References
3- damiri.fr/en/cve/CVE-2026-60121nvdThird Party AdvisoryExploit
- www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-phpnvdThird Party AdvisoryExploit
- www.vitec.com/solutions/iptv-distributionnvdProduct
News mentions
0No linked articles in our index yet.