Executive brief
Softaculous Virtualizor is a virtualization management platform for hosting providers. An unauthenticated remote attacker can exploit an OS command injection vulnerability in the billing module to execute arbitrary commands with root privileges, gaining complete control of the hypervisor and all hosted virtual machines. This is a critical vulnerability that requires an immediate patch deployment.
Technical details
The vulnerability exists in the billing module handler where user-supplied input in the uid field of a crafted billing_data POST parameter is deserialized and passed unmodified to proc_open() via vexec(), enabling OS command injection. The flaw allows unauthenticated attackers to bypass authentication through specific parameter combinations and inject arbitrary shell payloads, resulting in remote code execution as the root user.
Affected products
- Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0
Timeline
- 2026-09-22: disclosed: CVE-2026-43641 published on NVD
- 2026-09-01: patched: Virtualizor 3.2.9 Patch 9 released with security fixes