PT-2026-57817 · Vitec · Vitec Flamingo

Adam Outikni + 1 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-61498

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vitec Flamingo version 4.12.2

Description An unauthenticated OS command injection exists in the 'admin/ajax/gen graphs.php' endpoint. Remote attackers can execute arbitrary commands with root privileges by providing shell metacharacters through the start, end, key, or format HTTP GET parameters. This occurs because the graph generation script fails to sanitize input before passing it to shell commands via the passthru() function, and the web server context possesses passwordless sudo access.

Recommendations Update Vitec Flamingo version 4.12.2 to a patched version. As a temporary workaround, restrict access to the 'admin/ajax/gen graphs.php' endpoint.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-61498

Affected Products

Vitec Flamingo

References · 9

• 🔥 https://damiri.fr/en/cve/CVE-2026-61498 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61498 · Security Note
• https://twitter.com/OrizonCyber/status/2076713285823435002 · Twitter Post
• https://vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-gen-graphs-php · Note
• https://twitter.com/SecurityAr58409/status/2076714056816185841 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076723642453422088 · Twitter Post
• https://twitter.com/CVEnew/status/2076722750203297845 · Twitter Post
• https://vitec.com/solutions/iptv-distribution · Note
• https://twitter.com/VulmonFeeds/status/2076737142684872864 · Twitter Post