AI analysis
CVE-2026-65639 is an OS command injection flaw (CWE-78, CVSS 4.0 score 9.5, critical) in the advanced-rule parser of ConfigServer Security & Firewall (CSF), a widely used Linux firewall suite. It is triggered when the parser processes rule data supplied by a configured allow/deny feed: because feed-supplied rule content is not sufficiently validated, an attacker who can control the contents of such a feed (for example by controlling or tampering with the feed source) can inject and execute arbitrary shell commands. Injected commands run as root, so successful exploitation yields full takeover of the host, with high impact to confidentiality, integrity, and availability (the CVSS AT:P metric reflects the precondition that a feed must be configured and attacker-influenced). Affected deployments include versions originally distributed by ConfigServer and versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed the issue in version 16.30, while other independently maintained forks may also be affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and there is no confirmed exploitation in the wild at this time.
What to do: Upgrade the WebPros-maintained CSF to version 16.30 or later. Operators running ConfigServer-distributed builds or third-party forks should confirm with their maintainer whether a fixed release exists, and in the meantime audit all configured allow/deny feeds - restrict feed sources to trusted HTTPS URLs under your control and treat feed content as untrusted input. Because injected commands run as root, prioritize patching internet-facing servers first.
Affected
| ConfigServer Security & Firewall (CSF) - original distribution | — |
| WebPros ConfigServer Security & Firewall (CSF) - WebPros-maintained fork | versions containing the vulnerable code prior to the fix; WebPros addressed the vulnerability in version 16.30 |
| Other independently maintained CSF forks/derived versions | — |
Estimated exposure
mass~hundreds of thousands of servers run CSF (install base spanning cPanel/WHM and standalone Linux hosts), though the directly exploitable subset is likely… — Basis: CSF is one of the most widely deployed free firewall suites on cPanel/WHM and other internet-facing Linux servers, an install base historically numbering in the hundreds of thousands per public deployment and scanning data, with the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.