Executive brief
Wgcloud is a monitoring and management platform. The vulnerability allows an attacker to execute arbitrary system commands on the server hosting Wgcloud by sending a specially crafted request to the /warnScript/test endpoint. This could give an attacker full control over the monitored infrastructure.
Technical details
This is a command injection vulnerability in the /warnScript/test endpoint of Wgcloud 3.6.4. The "content" parameter is directly concatenated into a Java ProcessBuilder command without sanitization or validation, allowing arbitrary command execution. The vulnerability requires network access to the endpoint but does not require authentication based on the reported CVSS score. An attacker can craft a payload using shell metacharacters to break out of the intended command and execute arbitrary system commands with the privileges of the Wgcloud process. The CVSS 4.3 score indicates low confidentiality impact without integrity or availability impact in the base case, though practical exploitation could yield more severe consequences.
Affected products
- Wgcloud Wgcloud 3.6.4
Timeline
- 2026-08-26: disclosed