CVE-2026-110669
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A security vulnerability has been detected in cemtan sar2html 4.0.0 affecting the deleteHost/deleteRange/deleteAll functions in sar2html.py. The manipulation leads to missing authentication and the attack may be performed remotely.
Risk Assessment
A remote attacker can invoke deletion functions without authentication, potentially leading to data loss or service disruption.
Recommendation
Restrict network access to the sar2html application and monitor the project for a fix, as the reported issue has not yet been addressed.
Other vulnerabilities in sar2html
See all- CVE-2026-110670High
A SQL injection vulnerability was found in cemtan sar2html 4.0.0, in the updateDb function of sar2html.py within the Archive Processing component. Manipulation of the s2host argument allows SQL injection. The attack can be launched remotely.
- CVE-2026-110668High
In cemtan sar2html 4.0.0, the index function in sar2html.py does not properly sanitize the sort argument, leading to SQL injection. The attack can be carried out remotely, and a public exploit is available that could be used in attacks. The project was informed of the issue but has not responded.
- CVE-2026-110667High
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-110666Medium
A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-18719Medium
A vulnerability in sar2html 4.0.0 affects an unknown part of the file sar2html.py in the Search component. Manipulating the Search argument results in SQL injection. The attack can be initiated remotely, and the exploit is now public.
Original NVD description (English source)
A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS