CVE-2026-110670 — Sar2html
HIGHCVE-2026-110670 is a high-severity (CVSS 7.3) CWE-74 vulnerability in cemtan sar2html. No vendor fix is recorded yet; mitigation options are listed below.
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the…
Description
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Products
sar2htmlcemtanDetection & mitigation playbook
Vendor / applianceDetect
Inventory every cemtan sar2html deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2026-110670 yet — track the cemtan sar2html advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-110670 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.