CVE-2026-85040

Name of the Vulnerable Software and Affected Versions ZhongBangKeJi CRMEB versions prior to 6.0.0

Description An OS command injection flaw exists in the Custom Scheduled Task Feature. The issue occurs when the eval() function in the '/adminapi/system/crontab/save' endpoint processes the customCode variable. This allows a remote attacker to execute arbitrary operating system commands. Although the vendor describes this as debug-only behavior, the isSafePhpCode blacklist does not effectively prevent remote code execution (RCE), which is the ability to execute arbitrary code on a remote machine.

Recommendations Update to a version later than 6.0.0. Restrict access to the '/adminapi/system/crontab/save' endpoint to minimize the risk of exploitation.