CVE-2026-118607 is a command injection vulnerability in the diagapp component of Alpine iLX-F511 devices. It allows an attacker with physical access to execute arbitrary code as root without authentication. The flaw arises from improper validation of user-supplied input used in system calls.