CVE-2026-110670: SQL Injection in cemtan sar2html

This vulnerability affects cemtan sar2html version 4.0.0. The updateDb function in sar2html.py improperly sanitizes the s2host argument, enabling remote attackers to perform SQL injection attacks. This could lead to unauthorized database queries or modifications. The issue was reported early to the project, but no fix or official response has been provided. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation allows remote attackers to inject SQL commands via the s2host argument, potentially leading to unauthorized data access or modification in the affected database. The impact is limited to the confidentiality, integrity, and availability of the database managed by the vulnerable function. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable service and validate or sanitize inputs to the updateDb function if possible.