Vulnerability · Published Sep 3, 2026 · Assigned by VulDB

CVE-2026-85040ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

Medium 4.7

In plain English

A medium-severity OS command injection in CRMEB from ZhongBangKeJi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)2.1%top 18.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Vendor documents this as deliberate debug-only behavior. But isSafePhpCode blacklist offers no real RCE containment.

Affected products (as reported)

Vendor	Product	Versions
ZhongBangKeJi	CRMEB	6.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-398300 | ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection vdb-entry, technical-description
VDB-398300 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-85040 | CVE Analysis and Report third-party-advisory
Submit #887316 | ZhongBangKeJi CRMEB unknown OS Command Injection third-party-advisory
https://github.com/xiaohai12138-1/cve/blob/main/CRMEB/CRMEB%20Backend%20custom%20%20scheduled%20task%20functionality%20%20RCE.md exploit