This vulnerability exists in alseambusher/crontab-ui through version 0.4.2. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validating the content. The hook field from the imported file is used unsafely in crontab.js's makeCommand() function, which constructs shell commands without sanitizing this input. Consequently, an attacker can craft a malicious hook value that results in arbitrary OS command execution when the cron job runs next.

An unauthenticated remote attacker can execute arbitrary system commands on the host running crontab-ui by exploiting this vulnerability. This can lead to full system compromise, including confidentiality, integrity, and availability impacts, as reflected by the CVSS 3.1 score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing untrusted crontab database files and restrict access to the POST /import endpoint to trusted users only.