Vitec Flamingo 4.12.2 — CVE-2026-61498 (Critical)

Date Jul 13, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Vitec · Flamingo 4.12.2

CVE CVE-2026-61498

Critical vendor advisory CVE-2026-61498

Summary

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Vitec Flamingo 4.12.2. Patch or mitigate promptly.

Operator check

Review CVE-2026-61498 in your asset inventory. Apply patches per vendor guidance and verify Flamingo 4.12.2 is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-61498 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed