A critical OS command injection vulnerability in 4MOSAn GCB Doctor allows unauthenticated remote attackers to achieve full system execution on the host server.

The vulnerability originates from an unremoved ADOdb test page that fails to sanitize user-supplied input. An unauthenticated attacker can inject arbitrary operating system commands into this parameter, resulting in code execution with the privileges of the web service.

OS command injection is a high-impact vulnerability that allows attackers to gain persistent access to the underlying server. This can result in complete data exfiltration, malware installation, or the usage of the server as a launchpad for further internal attacks. The CVSS score of 9.8 reflects the high probability of total system compromise.

Immediate Action: Upgrade to version 20260621 or later immediately, as specified by the vendor. Ensure the FreeBSD-GCB Management Center security upgrade is also applied.

Proactive Monitoring: Review server logs for unexpected process execution or shell command patterns originating from the web application user.

Compensating Controls: Remove or restrict access to the vulnerable ADOdb test page via server configuration files or a WAF rule that blocks access to known test or debug files.

Public Exploit Available: No (No confirmed weaponized exploit or public repository identified in curated data).

The availability of a vendor-provided fix makes remediation straightforward. Organizations should prioritize the update to version 20260621 to close this critical security gap. Following the update, conduct an audit to ensure no other test or debug pages remain exposed in the production environment.