{"id":"CVE-2026-65639","aliases":["EUVD-2026-75597","GHSA-hxr2-4c3f-5rpg"],"status":"published","title":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a...","description":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.\n\nThe vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security \u0026 Firewall (CSF) may also be affected and should be evaluated independently.","severity":{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01419,"percentile":0.73,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-09-10T16:24:52Z","modified":"2026-09-10T19:54:25Z","products":[{"vendor":"configserver","product":"configserver security \u0026 firewall"},{"vendor":"webpros","product":"configserver security \u0026 firewall"}],"references":[{"url":"https://support.cpanel.net/hc/en-us/articles/43387923160343-Security-CVE-2026-65639-CSF-Security-Release"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65639"},{"url":"https://github.com/advisories/GHSA-hxr2-4c3f-5rpg"}],"sources":{"cve":[{"id":"CVE-2026-65639","description":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.\n\nThe vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security \u0026 Firewall (CSF) may also be affected and should be evaluated independently.","status":"published","published":"2026-09-10T16:24:52.871Z","modified":"2026-09-10T18:19:47.504Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-75597","description":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.\n\nThe vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security \u0026 Firewall (CSF) may also be affected and should be evaluated independently.","status":"published","published":"2026-09-10T16:24:52Z","modified":"2026-09-10T18:19:47Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T17:28:23.831795Z"}],"ghsa":[{"id":"GHSA-hxr2-4c3f-5rpg","title":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a...","description":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.\n\nThe vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security \u0026 Firewall (CSF) may also be affected and should be evaluated independently.","status":"published","published":"2026-09-10T18:31:46Z","modified":"2026-09-10T18:32:56Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:11:42.667371Z"}],"nvd":[{"id":"CVE-2026-65639","description":"OS command injection in the advanced-rule parser of ConfigServer Security \u0026 Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.\n\nThe vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security \u0026 Firewall (CSF) may also be affected and should be evaluated independently.","status":"published","published":"2026-09-10T17:17:05.19Z","modified":"2026-09-10T19:54:25.81Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:46.271848Z"}]}}