CVE-2026-61498

Name of the Vulnerable Software and Affected Versions Vitec Flamingo version 4.12.2

Description An unauthenticated OS command injection exists in the 'admin/ajax/gen graphs.php' endpoint. Remote attackers can execute arbitrary commands with root privileges by providing shell metacharacters through the start, end, key, or format HTTP GET parameters. This occurs because the graph generation script fails to sanitize input before passing it to shell commands via the passthru() function. The ability to gain root privileges is facilitated by the web server context having passwordless sudo access.

Recommendations For version 4.12.2, apply the available security patch immediately. As a temporary mitigation, restrict access to the 'admin/ajax/gen graphs.php' endpoint or avoid using the start, end, key, and format parameters until the patch is applied.