h-ui CVE-2026-107202

Exploitation requires authenticated access to the h-ui administrative API and the ability to set the 'listen' configuration field, which lacks port/format validation; the attacker supplies a value containing shell metacharacters that h-ui interpolates via fmt.Sprintf into an nftables/iptables rule string and executes with bash -c as root. Limiting factors: valid administrator authentication is mandatory (despite the input vector's PR:N), and the affected deployment must be running h-ui v0.0.25 or earlier. The key mitigating factor is the admin-credential prerequisite, so realistic risk concentrates on multi-operator or weakly-secured panels; the aggravating factor is that successful injection runs as root, giving full host compromise.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores this 9.1 and implies remote unauthenticated exploitation, but this directly CONFLICTS with the description, which states exploitation requires 'an authenticated administrator' submitting the malicious value through the administrative API. This is a significant discrepancy: PR:N (no privileges) in the vector cannot be reconciled with an explicitly authenticated administrative action - the vector should almost certainly be PR:H, which meaningfully lowers real-world risk since an attacker must already possess admin credentials. Additionally, the vector sets A:N (no availability impact) despite the flaw yielding arbitrary OS command execution as root, which would normally carry full C/I/A impact. No EPSS score, KEV listing, or proof-of-concept was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the CWE-77 command-injection pattern via fmt.Sprintf into bash -c is well understood and easy to weaponize once admin access exists, but the authentication prerequisite makes this a post-authentication privilege/impact escalation rather than a wormable, widespread threat. Net: a genuinely severe technical impact (root code execution) gated behind administrative authentication, so priority is high only for environments where admin access is shared, weakly protected, or where lower-trust operators manage the panel.

An authenticated administrator (or an attacker who has obtained admin credentials or hijacked an admin session) submits a 'listen' configuration value containing shell metacharacters through the h-ui admin API. The application interpolates this value into an nftables/iptables rule string with fmt.Sprintf and runs it via bash -c as root, so the injected commands execute with root privileges. No public proof-of-concept was provided, but the flaw is trivially exploitable given the missing port/format validation.