CVE-2026-67402 PUBLISHED

Assigner: hackerone
Reserved: 29.07.2026 Published: 03.09.2026 Updated: 03.09.2026

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	Low
Attack Complexity	Low	Integrity	High	Integrity	Low
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	WebPros
Product	ConfigServer Security & Firewall
Versions	Default: unaffected affected from 14.02 to 16.31 (excl.)

Vendor	ConfigServer
Product	ConfigServer Security & Firewall
Versions	Default: unaffected affected from 14.02 to * (excl.)

Workarounds

Disable Messenger v3 by setting MESSENGERV3 = "0" until version 16.31 can be installed. This is the shipped default.

References

https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026

Problem Types

CWE-552 Files or Directories Accessible to External Parties CWE