Read the docs
TI-2025-13341 Aliases CVE-2025-14601GHSA-mjxg-34vj-37wc

vsDesk Task Scheduler OS Command Injection

Priority MEDIUM 41CWE-676Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01061 64th percentileScored 2026-11-07
Fix Fixed vsDesk (vsDesk): 14.0101

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vsDeskvsDesk11.06.0214.0101Patch availableCNA
  • vsDesk VendorvsDesk Affected 11.06.02 Fixed in 14.0101 Patch available CNA

Remediation

  • Fix · CNA vsDesk (vsDesk) Fixed in 14.0101

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14601
  2. 2026-10-03 Alias added: GHSA-mjxg-34vj-37wc

References

Other 1

  • TI-2025-13340 Admin Account Takeover via Path Traversal in vsDesk CVSS 4.0CRITICAL 9.3
  • TI-2026-01974 ) Missing Server-Side File Extension Validation in vsDesk CVSS 4.0CRITICAL 9.4
  • TI-2025-13343 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection CVSS 4.0HIGH 8.8
  • TI-2025-13342 Weak File Name Generation in vsDesk CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences