External risk intelligence

Crontab-UI Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72589

The vulnerability exists in crontab-ui, a web-based interface for managing crontabs. Such management tools are commonly deployed as web applications intended for administrative access, frequently exposed via network interfaces to facilitate remote management, making the POST /import endpoint a likely target for remote interaction.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the crontab-ui software, which allows for the remote execution of arbitrary system commands. This issue stems from the improper handling of imported database files, potentially enabling unauthorized command execution on systems using this software. The primary concern at this time is to confirm whether this specific technology is in use within our environment to assess relevance and potential exposure.

Attackers can run commands by uploading bad files.
Critical vulnerability impacts widely used cron job management.
Confirm if crontab-ui is used; assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by remotely sending a specially crafted crontab database file to the application's import feature. This file, when processed, allows arbitrary commands to be injected and executed on the server during the next scheduled cron job.

Network access required.
Import crafted database file.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could execute arbitrary system commands by importing a crafted crontab database file. This occurs because the application's import functionality does not validate the provided `.db` files, and a malicious value within the file can be directly embedded into a shell command, leading to code execution when the cron job runs.

System commands and application database.
Importing a crafted crontab database file.
Arbitrary code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS command injection vulnerability in crontab-ui affects the POST /import endpoint, allowing unauthenticated remote attackers to execute arbitrary system commands. Action owners should first identify all instances of crontab-ui, assess their reachability and criticality, and determine the accountable application or platform owner to prioritize remediation efforts.

Identify crontab-ui instances and reachability.
Confirm accountable application or platform owner.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is crontab-ui?

Crontab-ui is an open-source, web-based management tool designed to simplify the creation, editing, and monitoring of cron jobs—the scheduled tasks that automate system maintenance on Linux and Unix-like servers. It provides a visual dashboard to replace manual command-line configuration, making it a popular choice for administrators who need to manage complex job schedules across multiple environments.

How does the CVE-2026-72589 command injection work?

This vulnerability is classified as CWE-78 (OS Command Injection). It occurs because the application fails to validate the contents of uploaded database files. When a user imports a crafted file, the system takes a specific data field from that file and includes it directly in a shell command without sanitizing it. This allows an attacker to inject their own system commands, which the server then executes automatically when the next scheduled cron task runs.

Do I need to be authenticated to trigger this flaw?

No, authentication is not required to trigger this vulnerability. An attacker can initiate the exploit remotely by sending a specially crafted database file to the application's import endpoint. It is important to note that the malicious commands are not executed the instant the file is uploaded, but rather when the application subsequently processes that data during a scheduled cron execution cycle.

Why is this a risk for my network-facing infrastructure?

According to Halo Surface Signal, this vulnerability is considered a high-priority risk because crontab-ui is a management tool frequently deployed with network-facing interfaces to allow for remote administration. If your instance is accessible over the internet or an untrusted network, an attacker can target the import endpoint to gain unauthorized control over the underlying server without needing any prior credentials.

How should I respond if I am running crontab-ui?

Your first step is to locate all instances of crontab-ui within your infrastructure and confirm who owns or manages them. Once identified, evaluate whether these instances are reachable from external networks. Focus on restricting access to these management interfaces to trusted, internal networks only while you coordinate with your team to prioritize and implement the necessary updates or security configurations to block the import vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.