CVE-2026-60121CWE-78command-injection

CVE-2026-60121

Critical · published July 13, 2026

CVSS v3.1
9.8
EPSS
3%
Percentile
88.5
In the wild
Unconfirmed
What it is

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03304 · 88.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-13T18:16Z
Affected products (1)
ProductVersionsFixed in
vitec/flamingo≤ 4.12.2—
References (3)
https://damiri.fr/en/cve/CVE-2026-60121 · [email protected]https://www.vitec.com/solutions/iptv-distribution · [email protected]https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-php · [email protected]
EPSS history
Timeline
  • 13 JUL 13:11Z
    Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php
    cvelistv5