CVE-2026-72590 — alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafte…
Published: 2026-08-10 · CVSS: 9.8 · CVSS 3.1
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7