An OS command injection flaw is present in the import feature of the crontab‑ui application through version 0.4.2, enabling an unauthenticated remote attacker to execute arbitrary system commands by uploading a crafted crontab database file. The POST /import endpoint accepts any .db file and overwrites the application database without validating its contents, allowing a malicious hook value to be injected into a shell command. As a result, the attacker can run arbitrary commands on the host when the scheduler processes the imported database.

Targeted products include alseambusher’s crontab‑ui, applications that are running version 0.4.2 or any earlier release. The vulnerability affects the entire installation because the database overwrite applies globally across the application.

The flaw attains a CVSS score of 9.8, indicating critical severity. The EPSS score is 1%, indicating a low but nonzero exploitation probability. The lack of authentication and the direct shell injection make exploitation straightforward. The attacker does not need special privileges beyond network access to the application; simply posting a modified .db file to /import will allow execution of commands on the host system during the next cron cycle. The vulnerability is not yet listed in the CISA KEV catalog, but that does not diminish its potential for use in active exploits.