A command injection vulnerability exists in Bastillion's SystemKtrl.java module. Unvalidated input can cause the application to execute arbitrary system commands on the host, potentially leading to full compromise of the underlying operating system, loss of confidentiality, integrity, and availability. The flaw is mapped to CWE‑74 and CWE‑77.

The affected product is Bastillion System Management System released by bastillion‑io. Versions up to and including 4.0.1 contain the flaw. The issue resides in the System Management Module, specifically the src/main/java/io/bastillion/manage/control/SystemKtrl.java file. No other versions or components are known to be impacted.

The CVSS base score is 5.1, indicating moderate risk. EPSS is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. However, the description confirms that the flaw can be triggered remotely and a public exploit exists, indicating potential immediate threat if the system is exposed to untrusted networks. Attackers would start by sending a crafted request to the vulnerable endpoint, and the lack of proper input validation would allow arbitrary commands to be executed on the host.