Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
AI analysis
CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.
What to do: Upgrade the WebPros-maintained CSF fork to version 16.30 or later and verify which fork and version your deployment actually uses. If you run the original ConfigServer distribution or a third-party fork, monitor the respective maintainer for a patched release and assess your version independently. Until patched, restrict unauthenticated access to the CSF web interface (e.g., limit it to trusted management networks or localhost/VPN) and watch for unexpected command execution by the CSF service account.
Affected
| ConfigServer Security & Firewall (CSF) | — |
| WebPros ConfigServer Security & Firewall (WebPros-maintained fork) | Versions containing the vulnerable code; fixed in version 16.30 |
| Other independently maintained CSF forks | May also be affected; should be evaluated independently (no version ranges or fixes provided) |
Estimated exposure
masslikely on the order of 100,000+ hosting server installations (order-of-magnitude estimate; exact published counts not available) — CSF is the de facto standard firewall for cPanel/WHM hosting servers, a platform deployed on hundreds of thousands of servers, so the vulnerable install base plausibly exceeds 100,000 systems, though only instances where the CSF web…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.