Quick answers
- Is CVE-2026-44888 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44888 being exploited in the wild.
- How severe is CVE-2026-44888?
- Critical severity, with a CVSS score of 9.8, published 27 May 2026.
- Which products and versions are affected?
- Leiweibau Pi.Alert Prior to 2026-05-07.
- Is there a fix for CVE-2026-44888?
- A patch was published on 2026-05-07: Vulnerability fixed in version released on this date. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44888 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44888?
- Check whether you run Leiweibau Pi.Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A code injection vulnerability exists in Pi.Alert's `SaveConfigFile()` endpoint within `front/php/server/files.php`. The application fails to validate or sanitize numeric configuration parameters (such as `SMTP_PORT`, `REPORT_MQTT_PORT`, or `AUTO_DB_BACKUP_KEEP`) before writing them to `pialert.conf`. Because the background cron process executes `pialert.py`, which loads this configuration file using Python's `exec()` function every 3–5 minutes, an attacker can inject arbitrary Python code. On default installations where `PIALERT_WEB_PROTECTION` is disabled, this can be exploited over the network without authentication to achieve OS-level Remote Code Execution (RCE) as the user running the service (often root). The issue was addressed in the 2026-05-07 update.
Affected products
- leiweibau Pi.Alert Prior to 2026-05-07
Timeline
- 2026-05-07: patched: Vulnerability fixed in version released on this date.
- 2026-05-08: advisory: GitHub Security Advisory published.
- 2026-05-27: disclosed: CVE-2026-44888 published to NVD.