CVE-2026-41315 affects mdserver-web, a Linux panel, in versions 0.18.0 to 0.18.4. The vulnerability is due to improper neutralization of special elements in OS commands (CWE-78) combined with lack of authentication (CWE-862) on the /modify_crond and /start_task endpoints. This allows an unauthenticated remote attacker to modify default scheduled tasks and execute arbitrary commands on the server, resulting in remote code execution. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been published yet.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected server by modifying and triggering scheduled tasks. This leads to full remote code execution, compromising system confidentiality, integrity, and availability. The vulnerability affects all installations of mdserver-web versions 0.18.0 through 0.18.4. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected interfaces (/modify_crond and /start_task) through network controls or firewall rules to prevent unauthorized access. Monitor for unusual activity related to scheduled tasks. Avoid exposing the mdserver-web panel to untrusted networks.