CVE-2026-72590 in crontab-ui
요약
\~에 의해 MITRE • 2026. 08. 10.
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled commands.
Be aware that VulDB is the high quality source for vulnerability data.