CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
- CWE
- CWE-78
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- WebPros ConfigServer Security & Firewall
- ConfigServer ConfigServer Security & Firewall
Weakness type
Related vulnerabilities
- CVE-2026-19136 — A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application,...
- CVE-2026-73694 — FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
- CVE-2026-73693 — FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
- CVE-2026-65639 — OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a...
- CVE-2026-81468 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...
- CVE-2026-81467 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...
- CVE-2026-64837 — ICEcoder through 8.1 OS Command Injection via lib/properties.php
- CVE-2026-88889 — Renovate before 44.14.7 Command Injection via distributionType