---
id: CVE-2026-65638
title: >-
  Improper escaping of a request URL in  ConfigServer Security & Firewall allows
  an unauthenticated remote attacker to execute arbitrary commands as the CSF
  service account via shell command injection.


  The vulnerability affects versions o…
summary: >-
  Improper escaping of a request URL in  ConfigServer Security & Firewall allows
  an unauthenticated remote attacker to execute arbitrary commands as the CSF
  service account via shell command injection.


  The vulnerability affects versions o…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-78
vendor: WebPros
product: ConfigServer Security & Firewall
affected:
  - configserver_security_firewall >= 14.00 < 16.30
  - security_firewall >= 14.00 < *
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T18:19:11.551770Z'
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T18:19:18.373Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-65638'
references:
  - url: >-
      https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release
tags:
  - cve.org
epss: 0.0233
epssPercentile: 0.82795
ingestedAt: '2026-09-11T17:50:33.679Z'
---

## Overview

Improper escaping of a request URL in  ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection.

The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

## Affected

- `configserver_security_firewall >= 14.00 < 16.30`
- `security_firewall >= 14.00 < *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.