Intel

CVE-2026-61498

flamingo: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-2026-61498)

criticalEPSS 4.0%

Affected

  • vitec/flamingo between *..4.12.2

Description

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.

Source: NVD (NIST)CVE.org (MITRE)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

vitecflamingo
4.12.2

Metrics

XIEM Effective CVSS
9.8
Source: nvd-v3
EPSS percentile
90.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
—
Show all metrics
Severity
critical
Priority score
136.33
Exploit maturity
no public PoC known
CVSS v3
9.8
CVSS v4
9.3
EPSS score
4.0 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2026-07-13 14:16 UTC
CWE
CWE-78

Weakness classes (CWE)

  • CWE-78Base

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-14 14:42 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:* versions up to (including) 4.12.2
    • Reference Type: VulnCheck: https://damiri.fr/en/cve/CVE-2026-61498 Types: Exploit, Third Party Advisory
    • Reference Type: VulnCheck: https://www.vitec.com/solutions/iptv-distribution Types: Product
    • Reference Type: VulnCheck: https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-gen-graphs-php Types: Exploit, Third Party Advisory

Linked advisories