CVE-2026-44886: Pi.Alert SQL Injection Vulnerability

CVE-2026-44886 Overview

CVE-2026-44886 is a SQL injection vulnerability in Pi.Alert, an open-source WIFI and LAN intruder detector with web service monitoring. The flaw resides in the /pialert/php/server/devices.php endpoint, which accepts unauthenticated requests when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is concatenated into a backend SQL query without proper sanitization. Attackers can manipulate the parameter to inject arbitrary SQL statements against the application database. The vulnerability was introduced on 2024-06-29 and remained exploitable until the fix released on 2026-05-07. The issue is tracked under [CWE-89] and affects all Pi.Alert deployments within that window.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the Pi.Alert database, leading to confidentiality compromise of monitored network device data.

Affected Products

Pi.Alert versions released between 2024-06-29 and prior to 2026-05-07
Pi.Alert /pialert/php/server/devices.php web endpoint
Pi.Alert deployments exposing the web interface to untrusted networks

Discovery Timeline

2026-05-07 - Fix released by Pi.Alert maintainers
2026-05-27 - CVE-2026-44886 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44886

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the Pi.Alert PHP backend. The /pialert/php/server/devices.php route processes HTTP requests without requiring authentication. When the action query parameter is set to getDevicesTotals, the handler reads the scansource parameter and injects its value directly into a SQL query string. Attackers can supply crafted input that breaks out of the intended query context. The application then executes the modified query against the underlying database. This grants attackers the ability to read arbitrary tables, enumerate device records, and extract stored network monitoring data. The unauthenticated nature of the endpoint removes any access barrier to exploitation.

Root Cause

The root cause is improper neutralization of special elements in a SQL command. The scansource parameter is concatenated into the query string rather than passed through parameterized queries or prepared statements. No input validation or escaping is applied before query construction.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP GET or POST request to /pialert/php/server/devices.php with action=getDevicesTotals and a malicious scansource payload. The injected SQL executes within the privileges of the Pi.Alert database user. Public exposure of Pi.Alert web interfaces increases the practical reachability of this endpoint. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-44886

Indicators of Compromise

HTTP requests to /pialert/php/server/devices.php containing action=getDevicesTotals with anomalous scansource values
Presence of SQL meta-characters such as single quotes, UNION, SELECT, or -- in the scansource URL parameter
Unexpected database read activity originating from the Pi.Alert PHP process

Detection Strategies

Inspect web server access logs for requests matching the vulnerable endpoint with suspicious query strings
Deploy web application firewall rules that flag SQL injection patterns targeting the scansource parameter
Correlate Pi.Alert HTTP request logs with database query logs to identify malformed query construction

Monitoring Recommendations

Forward Pi.Alert web server and PHP error logs to a centralized logging platform for retention and analysis
Alert on repeated 500-class HTTP responses from devices.php, which may indicate injection probing
Monitor outbound traffic from the Pi.Alert host for signs of data exfiltration following suspicious requests

How to Mitigate CVE-2026-44886

Immediate Actions Required

Upgrade Pi.Alert to the version released on or after 2026-05-07, which contains the official fix
Restrict network access to the Pi.Alert web interface to trusted management networks only
Review web server access logs covering the period from 2024-06-29 onward for signs of exploitation

Patch Information

The Pi.Alert maintainers released a fix on 2026-05-07. Refer to the GitHub Security Advisory GHSA-m929-j7w8-334j for patch details and upgrade instructions.

Workarounds

Place the Pi.Alert web interface behind a reverse proxy that enforces authentication before reaching the application
Deploy a web application firewall rule that blocks requests to /pialert/php/server/devices.php containing SQL meta-characters in the scansource parameter
Isolate the Pi.Alert host on a dedicated management VLAN with strict ingress filtering

bash

# Example nginx rule to block suspicious scansource values
location /pialert/php/server/devices.php {
    if ($arg_scansource ~* "('|--|union|select|;)") {
        return 403;
    }
    proxy_pass http://pialert_backend;
}