CVE-2026-65638
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
| CWE | CWE-78 |
| Vendor | webpros |
| Product | configserver security & firewall |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for webpros configserver security & firewall
Be the first to know when new unknown vulnerabilities affecting webpros configserver security & firewall are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
WebPros / ConfigServer Security & Firewall
14.00 < 16.30
ConfigServer / ConfigServer Security & Firewall
14.00 < *