Critical severity9.8NVD Advisory· Published Jul 13, 2026· Updated Aug 14, 2026
CVE-2026-61498
CVE-2026-61498
Description
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2= 4.12.2+ 1 more
- (no CPE)range: = 4.12.2
- cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:*range: <=4.12.2
Patches
Vulnerability mechanics
References
3- damiri.fr/en/cve/CVE-2026-61498nvdThird Party AdvisoryExploit
- www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-gen-graphs-phpnvdThird Party AdvisoryExploit
- www.vitec.com/solutions/iptv-distributionnvdProduct
News mentions
0No linked articles in our index yet.