CVE-2026-107202 — CVE-2026-107202
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authent…
Published: 2026-10-07 · CVSS: 9.1 · CVSS 3.1
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7