CVE-2026-72589 in crontab-ui
Summary
by MITRE • 08/10/2026
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation. The hook field value is embedded directly into a shell command by crontab.js makeCommand() without sanitization, so a malicious hook value in the imported file results in command execution on the next cron execution cycle.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical os command injection flaw in the alseambusher/crontab-ui application version 0.4.2 and earlier, exposing systems to remote code execution attacks. The vulnerability stems from insufficient input validation within the application's database import functionality, specifically targeting the POST /import endpoint that processes arbitrary .db files. The flaw allows unauthenticated attackers to craft malicious crontab database files containing specially formatted hook field values that get directly embedded into shell commands without proper sanitization or escaping mechanisms.
The technical exploitation occurs through the crontab.js makeCommand() function which constructs shell commands by concatenating user-provided data directly into the command string. When an attacker imports a crafted database file containing malicious hook values, these values become part of the executed shell command during the next cron execution cycle, enabling arbitrary system command execution with the privileges of the running application process. This represents a classic command injection vulnerability where user-controllable input flows directly into operating system commands without proper validation or sanitization.
The operational impact of this vulnerability is severe as it provides attackers with complete control over the affected system, potentially allowing them to execute arbitrary commands, escalate privileges, exfiltrate data, or establish persistent access. The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely through the web interface, making it accessible to anyone who can reach the application. The attack vector leverages the legitimate import functionality of the application, making it harder to detect through traditional security monitoring approaches.
The vulnerability aligns with CWE-78, which specifically addresses OS Command Injection flaws where untrusted data is directly incorporated into shell commands without proper sanitization. This weakness falls under the broader category of injection vulnerabilities that are among the most prevalent and dangerous types of security flaws in web applications. From an attack framework perspective, this vulnerability maps to the execution phase in the ATT&CK methodology, specifically targeting system compromise through command and control operations.
Mitigation strategies should focus on implementing strict input validation and sanitization for all user-provided data within the import functionality. The application must validate and sanitize all hook field values before incorporating them into shell commands, using proper escaping mechanisms or parameterized command execution approaches. Additionally, the import process should implement file format validation, access controls to restrict database imports, and privilege separation to limit the impact of successful exploitation. Regular security updates and dependency management are essential to address similar vulnerabilities in third-party libraries that may be susceptible to similar injection flaws.