CVE-2026-44888: Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)

Synopsis

A Python config file injection vulnerability in Pi.Alert (the WIFI/LAN intruder detector and web service monitor) allows an unauthenticated remote attacker to write arbitrary Python code into pialert.conf via the SaveConfigFile() endpoint. Because the background cron process loads this file using Python's exec() every 3-5 minutes, the injected code executes automatically at the OS level with the privileges of that process. No authentication is required on default installations where PIALERT_WEB_PROTECTION is set to False, making this trivially exploitable over the network. The upstream project has not yet published a fix version; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The SaveConfigFile() endpoint is exposed over the network, so an attacker must be able to reach the Pi.Alert web service via HTTP/HTTPS to deliver the malicious payload.

• AuthenticationNot required

  On default installations PIALERT_WEB_PROTECTION is False, meaning no credentials of any kind are required to call the SaveConfigFile() endpoint.

• Victim interactionNot required

  The attacker writes the payload directly to the config file via the endpoint; no user action or social engineering is needed for the injected code to execute.

• Attack complexityDetail

  The exploit is reliable and condition-free: writing to the config file is straightforward and execution occurs automatically within the 3-5 minute cron window, with no race condition or environmental dependency required.

Blast Radius

• Executes arbitrary OS-level commands under the privileges of the Pi.Alert background cron process, giving the attacker a remote shell on the host.
• Reads all data accessible to that process, including network scan results, stored credentials, SMTP configuration values, and any secrets present on the filesystem.
• Modifies or deletes Pi.Alert configuration, scan data, and any other files writable by the process user, disrupting intruder-detection and monitoring functions.
• Enables lateral movement onto the local network by leveraging the host as a pivot point, since Pi.Alert has inherent network visibility into the monitored WIFI/LAN segment.