PT-2026-21316 · Kostasmitroglou · Thesystem

Sadik Cetin · Published 2026-02-20 · Updated 2026-03-12 · CVE-2019-25441

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thesystem version 1.0

Description The software contains a command injection issue that enables unauthenticated attackers to execute arbitrary system commands. Attackers can submit malicious input to the run command endpoint. Specifically, attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.

Recommendations Apply a fix to address the command injection issue in the run command endpoint. Restrict access to the run command endpoint. Sanitize or validate the command parameter to prevent the execution of arbitrary shell commands.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-25441

Affected Products

Thesystem

References · 6

• 🔥 https://exploit-db.com/exploits/47441 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25441 · Security Note
• https://github.com/kostasmitroglou/thesystem · Note
• https://vulncheck.com/advisories/thesystem-command-injection-via-runcommand-endpoint · Note
• https://t.me/cveNotify/155308 · Telegram Post