CVE-2026-110668 is a High severity (CVSS 7.3) SQL injection in cemtan sar2html 4.0.0. The sort argument of the index function in sar2html.py is not handled safely. The record says the project has not responded, so there is no fix to apply. Remove or restrict the tool.
What's affected
The record says cemtan sar2html 4.0.0 is affected. It says the project was told about the problem early, through an issue report, and had not responded when the record was written. We found no fixed release, so there is no patched version to name. Check the repository for changes before you decide.
The weaknesses are CWE-74, injection, and CWE-89, SQL injection. Per the record, the function index in sar2html.py takes a sort argument and uses it in a way that lets an attacker change the SQL query. The record says the attack can be carried out remotely and that an exploit has been made public. It does not mark the CVE as known exploited in CISA's catalog.
The record's score is 7.3 with no authentication required and low impact on each of confidentiality, integrity and availability. We found no second scoring source to compare with, so there is nothing to contrast it with.
How to check if you're exposed
Check whether sar2html is installed anywhere on your network. It may sit on an admin host that nobody thinks about.
find / -name "sar2html*" -maxdepth 6 2>/dev/null
If you find an installation, check the version file or the project folder against 4.0.0. Then check whether the web interface is reachable from outside the host. Look at the web server logs for requests to the index page that carry an unusual sort value, such as quotes or SQL keywords. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Take sar2html off the public internet. Put it behind a VPN or require authentication at the web server.
- If you do not need it, remove it.
- If you must keep it, review the code that handles the sort argument and allow only a short list of known column names.
- Check the web server logs for signs of probing, and rotate any credentials the application could read.
- Watch the project repository for a fix, and upgrade only after you confirm a release that addresses this.
Why it matters
SQL injection has been understood for decades, and the fix is also well known: use parameterized queries, and treat sort and order inputs as a choice from a list. Sort columns are a frequent gap because most database drivers cannot parameterize a column name.
Small, unmaintained admin tools often carry this kind of flaw for a long time because nobody is watching them. When a maintainer is silent, the safe move is to treat the tool as unpatched and reduce its exposure.
Quick check
Is there a patch?
We found none. The record says the project had not responded to the issue report.
Is it exploited in the wild?
The record says an exploit is public but does not flag a CISA Known Exploited Vulnerabilities listing. Treat a public exploit as a reason to move quickly.
Sources
Last reviewed: 18 October 2026.
