CVE-2026-48695

Name	CVE-2026-48695
Description	FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). This is identical in pattern to the Juniper plugin vulnerability. The $msg variable contains unsanitized attack data from command-line arguments. An attacker who can influence argv[] values can inject arbitrary shell commands. The fix is to replace exec() with file_put_contents() or use escapeshellarg().
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1138646

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fastnetmon (PTS)	bookworm, bookworm (security)	1.2.4-2+deb12u1	vulnerable
	trixie	1.2.8-1	vulnerable
	forky, sid	1.2.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fastnetmon	source	(unstable)	1.2.9-1	unimportant		1138646

Notes

https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48695-mikrotik-cmd-injection
Crosses no meaningful security boundary
https://github.com/pavel-odintsov/fastnetmon/pull/1047
https://github.com/pavel-odintsov/fastnetmon/commit/54a95427a1f6fe0237ddb0c3fc14622df1c93870 (v1.2.9)