EUVD-2026-70850
GHSA-88ch-qhvf-3vfj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated command execution with no user interaction; the Messenger v3 HTTPS requirement is a deployment condition, not attack complexity, so AC:L with full CIA impact as the Apache user.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
4DescriptionCVE.org
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Articles & Coverage 1
AnalysisAI
Remote unauthenticated command execution in ConfigServer Security & Firewall (CSF) arises from an insecure Apache configuration that maps /usr/bin as a CGI directory on the Messenger v3 HTTPS virtual host. An attacker whose IP has been blocked by CSF can request any executable under /usr/bin and have it run as the Apache user, turning a blocklist-facing service into an arbitrary command-execution vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target host runs CSF with the Messenger v3 feature AND its HTTPS mode enabled - this non-default configuration is what exposes the vulnerable Apache virtual host that maps /usr/bin as CGI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue rather than an inflated CVSS score: the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.2) reflects network-reachable, unauthenticated code execution, and the impact type is command execution - not merely information disclosure as the input tag suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade CSF to version 16.31 or later, which corrects the Apache configuration generated for the Messenger v3 HTTPS virtual host (per the cPanel CSF Security Release of September 3rd, 2026: https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, create an inventory of all CSF deployments and identify systems running versions prior to 16.31. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today