CVE-2019-25441 thesystem 1.0 Command Injection via run_command endpoint
Unauthenticated attackers can execute arbitrary system commands on the server via the run_command endpoint in thesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25441?
CVE-2019-25441 is a critical command injection vulnerability in kostasmitroglou thesystem, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.
Weakness: CWE-78
Which versions are affected by CVE-2019-25441?
It affects 1 product.
Products include Kostasmitroglou Thesystem.
How do I fix CVE-2019-25441?
No fix has been published for CVE-2019-25441 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-25441 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25441 exists.
Other vulnerabilities in kostasmitroglou thesystem
Sources
Also known as GHSA-r872-6r9v-fwgg.