CVE-2026-107202 in h-ui
Summary
by MITRE • 10/07/2026
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in h-ui administrative API versions v0.0.25 and below represents a critical command injection flaw stemming from insufficient input sanitization within the network configuration management subsystem. This specific weakness allows an authenticated administrator to execute arbitrary operating system commands with elevated privileges, specifically root-level access, by manipulating the listen configuration field. The core technical failure lies in how the application processes user-supplied data for network binding parameters. When a request is received containing shell metacharacters within the listen address or port specification, the backend logic fails to validate whether the input conforms to expected formats such as valid IP addresses and numeric port ranges. Instead of rejecting malformed inputs, the system proceeds to construct command strings using Go's fmt.Sprintf function, embedding the unsanitized user data directly into shell commands that are subsequently executed via bash -c with root privileges through nftables or iptables utilities.
From a technical perspective, this vulnerability exploits the lack of strict type checking and boundary validation on configuration parameters intended for network interface binding. The application assumes that because the endpoint is protected by authentication, any input provided will be benign. However, shell metacharacters such as semicolons, pipes, or backticks allow an attacker to terminate the intended command string and append additional commands. Since these commands are executed in a privileged context, the impact extends far beyond simple service disruption. An attacker can leverage this flaw to read sensitive system files, modify firewall rules to expose internal services, install persistent backdoors, or pivot further into the network infrastructure by executing arbitrary binaries. This scenario aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter, specifically reflecting sub-techniques involving shell commands like sh or bash.
The operational impact of this vulnerability is severe due to the combination of authentication bypass potential if credentials are compromised and the high privilege level at which the injected code executes. Even with valid administrative credentials, an attacker gains full control over the underlying host operating system. This can lead to complete compromise of the server hosting h-ui, potentially exposing other services running on the same machine or network segment. The ability to modify iptables or nftables rules also allows for denial-of-service conditions by blocking legitimate traffic or creating unauthorized access paths that bypass existing security controls. Furthermore, because the execution occurs as root, standard user-level restrictions and sandboxing measures are rendered ineffective against this attack vector.
Mitigation strategies must prioritize immediate patching to version v0.0.26 or later where these validation checks have been implemented. In environments where upgrading is not immediately feasible, administrators should implement strict input validation at the network perimeter using Web Application Firewalls configured to detect and block shell metacharacters in configuration parameters. Additionally, applying principle of least privilege by running h-ui services under a non-root user account can significantly reduce the impact if exploitation occurs. It is also recommended to review audit logs for any suspicious patterns involving unusual command executions or modifications to firewall rules during the window where the vulnerability was present. Regular security assessments and code reviews focusing on input handling in system configuration modules are essential to prevent similar vulnerabilities from being introduced in future updates.