CVE-2026-67599
Received Received - Intake

OS Command Injection in ClearOS Log Viewer

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webconfig user, and due to extensive NOPASSWD sudo privileges granted to that user by default, immediately escalate to root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-67599
EUVD
EUVD-2026-52409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
clearos clearos 7.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67599 is an OS command injection vulnerability in ClearOS 7.9's Log Viewer component. It allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter. This input is directly interpolated into a shell command in File.php, enabling command substitution payloads.

Detection Guidance

Check for suspicious activity in the Log Viewer component of ClearOS 7.9. Look for unsanitized input in the filter parameter of File.php. Review command execution logs for unexpected commands run by the webconfig user.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands as the webconfig user. Due to default NOPASSWD sudo privileges granted to this user, attackers can immediately escalate privileges to root, gaining full control over the affected system.

Mitigation Strategies

Update ClearOS to the latest patched version. Remove NOPASSWD sudo privileges for the webconfig user. Disable or restrict access to the Log Viewer component if not needed. Monitor for unauthorized command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart