CVE-2026-72590

Deferred Deferred - Pending Action

OS Command Injection in Crontab-UI

Publication date: 2026-08-10

Last updated on: 2026-08-28

Assigner: TuranSec

Description

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-28

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-72590

EUVD

EUVD-2026-55216

Affected Vendors & Products

Vendor	Product	Version / Range
alseambusher	crontab-ui	0.4.2
alseambusher	crontab-ui	to 0.4.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in crontab-ui version 0.4.2 or earlier. An unauthenticated remote attacker can inject malicious cron job entries by sending a specially crafted GET request to the /crontab endpoint with URL-encoded newlines in the env_vars parameter. The application fails to sanitize newline characters, allowing the attacker to append arbitrary commands to the crontab file.

Detection Guidance

Check for suspicious cron job entries by running 'crontab -l' on the system hosting crontab-ui. Inspect network traffic for GET requests to /crontab with URL-encoded newlines in the env_vars parameter. Look for unauthorized cron expressions or commands in the crontab file.

Impact Analysis

An attacker could execute arbitrary commands on the server running crontab-ui with the privileges of the application. This could lead to full system compromise, data theft, or disruption of services. Since no authentication is required, any internet-facing instance is vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update crontab-ui to the latest version beyond 0.4.2. If updating is not possible, disable the application or restrict network access to it. Review and remove any unauthorized cron jobs. Monitor system logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-72590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70