CVE-2026-67402

The record

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

Affected packages

Related vulnerabilities

• CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie… CWE-552
• CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display… CWE-552
• CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the… CWE-552
• CVE-2026-73735 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated… CWE-552
• CVE-2026-73736 A vulnerability in the web-based management interface of HPE Networking Fabric Composer… CWE-552
• CVE-2026-82020 Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability… CWE-552
• CVE-2026-75889 Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can… CWE-552
• CVE-2026-37065 Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in… CWE-552