CVE-2026-72590

CriticalCVSS 9.8

Published: 10/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Summary

crontab-ui through 0.4.2 has an OS command injection vulnerability that allows an unauthenticated attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

Risk Assessment

An attacker can execute arbitrary system commands on the server, potentially leading to full system compromise.

Recommendation

Update crontab-ui to a patched version and restrict access to the application.

Original NVD description (English source)

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.