CVE-2026-67599 is an OS command injection vulnerability in ClearFoundation ClearOS version 7.9 within the Log Viewer component. The vulnerability arises because the filter parameter is not properly sanitized before being interpolated into a shell command in File.php. Authenticated attackers can inject command substitution payloads to execute arbitrary commands as the webconfig user. Due to the default configuration granting the webconfig user extensive NOPASSWD sudo privileges, attackers can escalate privileges to root immediately after exploitation. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6. No vendor advisory or patch information is currently provided.

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands as the webconfig user and escalate privileges to root due to default sudo configurations. This results in full system compromise on ClearOS 7.9 installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Log Viewer component to trusted users only and monitor for suspicious activity involving the filter parameter. Consider reducing sudo privileges for the webconfig user if possible.