CVE-2026-65638 — WebPros / ConfigServer Security & Firewall

Description (CNA)

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

Affected (CNA)

Vendor / product	Versions
WebPros / ConfigServer Security & Firewall	affected 14.00 before 16.30
ConfigServer / ConfigServer Security & Firewall	affected 14.00 before *

CWE

CWE-78

References

https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.