Paper/Archive/CVE-2026-41315

CVE-2026-41315

midoks mdserver-web — mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 63.7.637 × 2012.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modify_crond and /start_task interfaces, it is possible to modify the default built-in scheduled tasks and start them, achieving RCE.

Affected

ProductAffectedFixed inSource

mdserver-web>= 0.18.0, <= 0.18.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/midoks/mdserver-web/security/advisories/GHSA-3h92-g9hr-xc25