CVE-2026-60121

Name of the Vulnerable Software and Affected Versions Vitec Flamingo version 4.12.2

Description An unauthenticated OS command injection exists due to a double-evaluation flaw in shell argument handling. The 'admin/ajax/ping.php' endpoint processes the host POST parameter using the escapeshellarg() function before passing it to a system wrapper. However, the wrapper retrieves the decoded value from argv and passes it into a second shell exec() call without further escaping. This allows remote attackers to execute arbitrary commands with root privileges via passwordless sudo.

Recommendations Update Vitec Flamingo version 4.12.2 to a patched version. As a temporary workaround, restrict access to the 'admin/ajax/ping.php' endpoint or avoid using the host parameter in that endpoint.