EUVD-2026-52554
GHSA-gxcj-787f-7pq4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Search endpoint requires low-privilege authentication; SQL injection yields partial data access and modification with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in sar2html 4.0.0's Search component permits remote low-privileged attackers to manipulate backend SQL queries by supplying crafted input to the Search argument in sar2html.py. Public exploit code exists (CVSS 4.0 E:P), though the vulnerability has not been confirmed as actively exploited in the wild via CISA KEV. The vendor did not respond to coordinated disclosure, leaving no official patch available and no timeline for remediation.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes a failure to sanitize or parameterize user-supplied input before it is embedded in an SQL query. sar2html is an open-source tool authored by cemtan that renders Linux SAR (System Activity Reporter) performance data as interactive HTML. The affected code path is the Search functionality within sar2html.py, where the Search argument is passed to a database query without adequate sanitization. The CPE string cpe:2.3:a:cemtan:sar2html:*:*:*:*:*:*:*:* with a wildcard version component suggests the flaw may affect the entire product lineage, though the disclosure specifically names version 4.0.0. SQL injection at this level can yield unauthorized read/write access to the underlying database used by the application.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure outreach. Organizations running sar2html 4.0.0 should consider the following compensating controls while awaiting an upstream fix. First, restrict network access to the sar2html interface to trusted internal hosts only, using firewall rules or reverse-proxy ACLs to prevent untrusted users from reaching the Search endpoint - this directly neutralizes the AV:N attack vector. Second, if the application must remain externally accessible, deploy a Web Application Firewall (WAF) with SQL injection detection rules targeting the Search parameter, accepting a potential false-positive rate on legitimate queries. Third, if application modification is feasible, apply parameterized queries or prepared statements in sar2html.py's Search handler, which eliminates the root cause regardless of input content. Fourth, audit database permissions and reduce the database account used by sar2html to the minimum required (read-only where possible), limiting the impact of a successful injection. The upstream repository and VulDB entry at vuldb.com/cve/CVE-2026-18719 should be monitored for any future patch release.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today