Is CVE-2026-72589 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72589?

CVE-2026-72589 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-72589

Description

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.