EUVD-2026-101632
GHSA-954w-m5gh-cchc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach sar2html Archive Processing endpoint
-
ExploitInject SQL payload via s2host argument
-
ExecutionupdateDb executes manipulated query
-
ImpactRead or tamper with database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the sar2html web/CGI interface so that input flows into the updateDb function of sar2html.py (the Archive Processing component), and to control the s2host argument, which is used unsanitized in a SQL query. Per the CVSS vector (PR:N/UI:N) the attack is unauthenticated and needs no user interaction, so against a default, network-exposed sar2html 4.0.0 deployment no special configuration is needed. The primary limiting factor is deployment scope: sar2html must be installed and its interface network-accessible to the attacker; impact is additionally bounded by the privileges and contents of the backend database the application queries. |
| Impact | Signals are mixed and lean toward a moderate, not urgent, priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which superficially argues for high priority; however, the impact metrics are all 'Low' (VC:L/VI:L/VA:L) and there is no scope change, yielding a MEDIUM base score of 6.9 rather than a critical rating. No EPSS probability was supplied, no POC is referenced, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - this is a high-reachability-but-limited-impact issue rather than a confirmed in-the-wild threat. The exploitation status is therefore 'no public exploit identified at time of analysis.' Two caveats to verify: (1) the only source is VulDB (a single reporter) and the vendor has not responded to the GitHub issue, so affected-version and fix data are unconfirmed; and (2) a SQL injection would normally be expected to carry higher confidentiality/integrity impact than the 'Low' ratings assigned here - the modest impact scoring should be confirmed against the actual injectable query context before deprioritizing. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a request to the Archive Processing component of sar2html that reaches the updateDb function in sar2html.py, supplying a malicious value in the s2host argument. Because s2host is concatenated into a SQL statement without sanitization (CWE-89), the attacker manipulates the query to read or alter database contents. No public exploit code is referenced, so exploitation would currently require an attacker to craft the injection manually. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
SQL injection in cemtan sar2html 4.0.0 lets remote attackers inject arbitrary SQL through the s2host argument processed by the updateDb function in sar2html.py (Archive Processing component); the CVSS vector indicates the attack is unauthenticated and requires no user interaction (PR:N/UI:N). Impact is bounded to limited confidentiality, integrity, and availability loss (CVSS 3.1 base 6.9-equivalent scope: C:L/I:L/A:L), constrained further by the privileges and contents of the backend database the application queries. No public exploit code has been identified at time of analysis, and no vendor patch is available - the project was notified via an issue report and has not responded.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project was informed through issue report https://github.com/cemtan/sar2html/issues/22 and has not responded, and no fixed version number has been published. Because the defect is unsanitized interpolation of the s2host parameter in updateDb, the most durable fix is to patch sar2html.py to use parameterized/prepared SQL statements (or strict allow-listing of s2host) and to deploy that fork; if you cannot patch, apply compensating controls. First, remove network exposure: bind the sar2html interface to localhost or place it behind an authenticating reverse proxy and firewall rules so only trusted administrators can reach it, accepting that this breaks any legitimate remote-reporting use case. Second, run the application's database connection under a least-privilege account restricted to the single sar2html schema with no DDL, file, or cross-database rights, which limits the blast radius of successful injection but does not prevent it. Third, deploy a WAF rule blocking SQL metacharacters and UNION/stacked-query patterns in the s2host parameter, understanding that WAF coverage is bypassable and should be treated as defense in depth rather than a fix. Monitor https://vuldb.com/vuln/419833 and the GitHub issue for an upstream fix and upgrade as soon as a patched release is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
sar2html is a small Python utility that parses sysstat 'sar' output and renders it as HTML graphs, exposing a web/CGI-style interface that stores parsed archive data in a backend database. The vulnerability class is CWE-89 (SQL Injection): the updateDb function in sar2html.py takes the user-supplied s2host argument and interpolates it into a SQL statement without parameterization or sanitization, so attacker-controlled text becomes part of the query. Per the CPE string cpe:2.3:a:cemtan:sar2html:*:*:*:*:*:*:*:* the affected product is the cemtan sar2html line with 4.0.0 explicitly named in the report; the wildcard version range indicates the vendor has not published a fixed release. The assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector confirms a network-reachable, unauthenticated, no-interaction attack against a default network-exposed deployment, with the practical severity ceiling set by the database account the tool runs under and the data it can reach.
Know when Sar2Html gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Remote unauthenticated injection into the s2host parameter gives AV:N/AC:L/PR:N/UI:N; impacts kept Low to mirror the limited data access indicated by the source scoring.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB