Read the docs
TI-2026-46787 Aliases CVE-2026-65638GHSA-8qv3-jfg8-cjvp

OS command injection in WebPros ConfigServer Security & Firewall

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0233 83rd percentileScored 2026-11-07
Fix Fixed ConfigServer Security & Firewall (WebPros): 16.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WebProsConfigServer Security & Firewall14.00 to before 16.3016.30Patch availableCNA
ConfigServerConfigServer Security & Firewall14.00 and later—No fix listedCNA
  • ConfigServer Security & Firewall VendorWebPros Affected 14.00 to before 16.30 Fixed in 16.30 Patch available CNA
  • ConfigServer Security & Firewall VendorConfigServer Affected 14.00 and later Fixed in — No fix listed CNA

Remediation

  • Fix · CNA ConfigServer Security & Firewall (WebPros) Fixed in 16.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WebPros ConfigServer Security & Firewall 16.30

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-46788 OS command injection in WebPros ConfigServer Security & FirewallPriority MEDIUM 46
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65638
  2. 2026-10-03 Alias added: GHSA-8qv3-jfg8-cjvp

References

Other 1

  • TI-2026-30342 WebPros cPanel and WHM Authentication Bypass via Login Flow KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-46792 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. CVSS 4.0HIGH 8.7
  • TI-2025-40383 Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)… CVSS 3.1HIGH 7.5
  • TI-2026-23322 Incorrect privileges management and insufficient path filtering allow to read arbitrary… CVSS 3.1HIGH 8.6
  • TI-2026-47685 Deserialization of untrusted data in WebPros WHMCS CVSS 4.0CRITICAL 9.3
  • TI-2026-23317 Authorization bypass in WebPros Comet Backup CVSS 4.0CRITICAL 9.9
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences