CVE-2026-72590
CriticalCVSS 9.8Summary
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled commands.
Risk Assessment
An attacker can execute arbitrary commands on the server in the context of the cron service, potentially leading to full system compromise, malware installation, and data breach.
Recommendation
Update crontab-ui to a patched version or apply a workaround such as validating and sanitizing the env_vars parameter to prevent newline injection.
Original NVD description (English source)
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled commands.