CVE-2026-43641
Softaculous Virtualizor OS Command Injection via Billing Module Handler
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 22, 2026
- Updated
- Oct 1, 2026
- Reserved
- May 1, 2026
Description
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
VirtualizorSoftaculous |
|
References
- VulnCheck Blogtechnical-descriptionexploit
- 3.2.9 Patch 9 Release Notesrelease-notespatch
- 3.3.0 Release Notesrelease-notespatch
- https://www.vulncheck.com/advisories/softaculous-virtualizor-os-command-injection-via-billing-module-handlerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.