A vulnerability was identified in cemtan sar2html 4.0.0. (CVE-2026-110666)

CVE-2026-110666 describes a path traversal vulnerability in the updateDb function of the sar2html.py file within cemtan sar2html version 4.0.0. The vulnerability arises from improper handling of file paths in the File Upload component, allowing remote attackers to manipulate paths and potentially access or modify files outside the intended directory. The project was notified early via an issue report but has not issued a response or patch. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with low attack complexity and impacts integrity and availability.

The vulnerability allows remote attackers to perform path traversal attacks, which can lead to unauthorized modification of files and potential disruption of service. There is no indication of confidentiality impact. The medium severity score reflects the potential for integrity and availability impacts without requiring authentication or user interaction.

No official fix or patch is currently available, and the project has not responded to the issue report. Users should monitor the project for updates or advisories. Until a patch is released, consider restricting access to the vulnerable component or implementing network-level controls to limit exposure.