/Vulnerability Library

sar2html <=3.2.2 Plot Parameter - Remote Code Execution

CVE-2025-34030
Verified

Description

sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands.

Severity

Critical

CVSS Score

10

Exploit Probability

52%

Affected Product

sar2html

Published Date

May 10, 2026

Template Author

gy741, tatanka97

CVE-2025-34030.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE ID:
cve-2025-34030
CWE ID:
cwe-78

References

https://nvd.nist.gov/vuln/detail/CVE-2025-34030https://vulncheck.com/advisories/sar2html-command-injectionhttps://github.com/cemtan/sar2htmlhttps://www.exploit-db.com/exploits/47204https://www.fortiguard.com/encyclopedia/ips/48624

Remediation Steps

Remove public access to affected sar2html deployments or apply vendor-provided fixes when available. Restrict access to trusted users and monitor for shell metacharacters in requests to index.php with the plot parameter.