CVE-2026-10873

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

• CWE-77
• CWE-78

• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/05-rstats.md
• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/05-rstats.md
• https://vuldb.com/cve/CVE-2026-10873
• https://vuldb.com/submit/831866
• https://vuldb.com/submit/831867
• https://vuldb.com/vuln/368363
• https://vuldb.com/vuln/368363/cti
• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/05-rstats.md

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10865The Cost Calculator Builder plugin for WordPress is vulnerab…5.3
• CVE-2026-10868A mass assignment vulnerability exists in the MISP user edit…9
• CVE-2026-1087The Guardian News Feed plugin for WordPress is vulnerable to…4.3
• CVE-2026-10870A flaw has been found in Shibby Tomato 1.28.0000. This affec…7.3
• CVE-2026-10871A vulnerability has been found in Shibby Tomato 1.28.0000. T…7.3
• CVE-2026-10872A vulnerability was found in Shibby Tomato 1.28.0000. This i…7.3
• CVE-2026-10874A vulnerability was identified in projectworlds Online Art G…6.3
• CVE-2026-10875A security flaw has been discovered in projectworlds Online …6.3
• CVE-2026-10876A weakness has been identified in SourceCodester Ship Ferry …6.3
• CVE-2026-10877A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-10878A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.7…8.8
• CVE-2026-10879DBI versions before 1.648 for Perl have a heap overflow when…9.8