CVE-2026-60121
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint. The flaw is a double-evaluation issue: escapeshellarg() is applied to the host parameter, but the system wrapper retrieves the decoded value from argv and passes it to a second shell_exec() call without sanitization.
Risk Assessment
An attacker can remotely execute arbitrary commands with root privileges (via passwordless sudo), leading to full server compromise, data theft, or service disruption.
Recommendation
Immediately update Vitec Flamingo to a patched version, or temporarily restrict access to the admin/ajax/ping.php endpoint to trusted IP addresses only.
Original NVD description (English source)
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.