CVE-2026-72589

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3

Description An OS command injection allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The 'POST /import' endpoint accepts arbitrary .db files and overwrites the application database without validation. Specifically, the hook field value is embedded directly into a shell command by the makeCommand() function without sanitization, leading to command execution during the next cron execution cycle.

Recommendations Update alseambusher/crontab-ui to version 0.4.3 or later.