OS Command Injection in ClearOS Log Viewer

ClearOS 7.9 contains a critical OS command injection vulnerability (CVE-2026-67599) located within the Log Viewer component. The vulnerability resides in the File.php script, which fails to properly sanitize input provided through the 'filter' parameter before interpolating it into a shell command. An authenticated attacker can exploit this flaw to execute arbitrary system commands running under the context of the webconfig user.

Of particular concern to defenders is the system's default configuration, which grants the webconfig user extensive NOPASSWD sudo privileges. This misconfiguration allows an attacker to transition from successful command injection to full root-level compromise of the ClearOS system without requiring further authentication or password entry. The vulnerability is specific to ClearOS 7.9 running on CentOS 7, and its impact is compounded by the high-privilege execution environment.

Impact

Successful exploitation results in full unauthorized command execution on the target ClearOS appliance. Because the webconfig user possesses NOPASSWD sudo rights, attackers can immediately pivot to root-level access. This allows for total system control, including data exfiltration, installation of persistent backdoors, and the potential for lateral movement within the network from the compromised appliance.

Recommendation

• Identify and restrict access to the ClearOS web management interface to trusted administrative network segments.
• Review and remove NOPASSWD sudo privileges for the webconfig user in /etc/sudoers to prevent immediate privilege escalation.
• Apply security patches provided by ClearFoundation for CVE-2026-67599 as soon as they become available.
• Audit web access logs for anomalous POST requests directed at the Log Viewer component containing shell metacharacters.