PT-2026-44076 · Pi.Alert · Pi.Alert

Aslein1413-Sys · CVE-2026-44888 · Published 2026-05-27 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pi.Alert versions prior to 2026-05-07

Description The SaveConfigFile() endpoint writes user-supplied numeric configuration values, such as SMTP PORT, directly into the pialert.conf file without validation. Because the background cron process loads pialert.conf using the Python exec() function every 3 to 5 minutes, an attacker can inject arbitrary Python code to achieve unauthenticated operating system-level remote code execution (RCE). On default installations where PIALERT WEB PROTECTION is set to False, no credentials are required to exploit this issue.

Recommendations Update to the version released on 2026-05-07.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-44888

GHSA-XG85-F8QW-7C5F

Affected Products

Pi.Alert

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44888.json · Exploit
• 🔥 https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-xg85-f8qw-7c5f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44888 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44888 · Vendor Advisory