An unauthenticated OS command injection vulnerability in crontab-ui allows remote attackers to execute arbitrary commands, creating a direct path to full system compromise.

This is an OS command injection vulnerability (CWE-78) where the /import endpoint accepts and processes arbitrary database files without validation, allowing an unauthenticated attacker to inject and execute system commands.

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability. Successful exploitation grants an unauthenticated attacker the ability to execute code with the permissions of the crontab-ui process, leading to complete system takeover, persistence, and potential lateral movement within the network.

Immediate Action: Update to the latest version of crontab-ui and verify that the /import endpoint is properly restricted or secured.

Proactive Monitoring: Monitor server activity for any unauthorized modifications to crontab files or the execution of unexpected system commands by the application process.

Compensating Controls: If an immediate update is not feasible, restrict network access to the crontab-ui web interface using a firewall or VPN to ensure only authorized users can access the application.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability necessitates an immediate update to the latest patched version. Given the lack of authentication, all instances of crontab-ui must be considered at high risk until the software is updated and the import functionality is verified as secure.