rConfig OS Command Injection Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2020-10221 · Published 08/03/2020 · updated 17/06/2026

rConfig OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
rconfig rconfig	`≤ 3.9.4`	No fix yet

Description

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

References

packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html · Exploit
cwe.mitre.org/data/definitions/78.html · Third Party Advisory
engindemirbilek.github.io/rconfig-3.93-rce · Exploit
EnginDemirbilek/EnginDemirbilek.github.io · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-10221

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free