CVE-2026-85040CWE-77CWE-78command-injection

CVE-2026-85040

Medium · published September 3, 2026

CVSS v3.1
4.7
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Vendor documents this as deliberate debug-only behavior. But isSafePhpCode blacklist offers no real RCE containment.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.02124 · 81.8th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-03T17:06Z
References (5)
https://github.com/xiaohai12138-1/cve/blob/main/CRMEB/CRMEB%20Backend%20custom%20%20scheduled%20task%20functionality%20%20RCE.md · [email protected]https://vuldb.com/cve/CVE-2026-85040 · [email protected]https://vuldb.com/submit/887316 · [email protected]https://vuldb.com/vuln/398300 · [email protected]https://vuldb.com/vuln/398300/cti · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 2%
    epss
  • 03 SEP 02:45Z
    ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
    cvelistv5