CVE-2026-65639
Received Received - Intake

OS Command Injection in ConfigServer Security & Firewall

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: HackerOne

Description
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-65639
EUVD
EUVD-2026-75597

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
configserver configserver_security_and_firewall From 2.15 (inc) to 16.30 (exc)
webpros configserver_security_and_firewall From 2.15 (inc) to 16.30 (exc)
configserver configserver_security_and_firewall 16.30
webpros configserver_security_and_firewall 16.30
configserver configserver_security_firewall to 16.30 (inc)
webpros webpros_security_firewall to 16.30 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS command injection vulnerability in the advanced-rule parser of ConfigServer Security & Firewall (CSF). A remote attacker who controls a configured allow or deny feed can execute arbitrary commands with root privileges due to insufficient validation of feed-supplied rule data.

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of CSF (2.15 through 16.29). Verify the installed version using the command: csf -v. Additionally, inspect the CSF configuration file at /etc/csf/csf.conf for untrusted remote allow or deny feed URLs in GLOBAL_DENY or GLOBAL_ALLOW options.

Impact Analysis

If exploited, an attacker could gain full control over the affected server, allowing them to execute any command as root. Most users are at lower risk since remote allow or deny feeds are not configured by default.

Mitigation Strategies

Immediately update CSF to version 16.30 or later using the appropriate commands for your OS. If updating is not possible, remove untrusted remote allow or deny feed URLs from /etc/csf/csf.conf, then restart CSF and LFD services using systemctl restart csf lfd. Clear cached rule data in /var/lib/csf/csf.gdeny if it exists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart