CVE-2026-85040: OS Command Injection in ZhongBangKeJi CRMEB

This vulnerability exists in ZhongBangKeJi CRMEB up to version 6.0.0 in the eval function of the /adminapi/system/crontab/save endpoint, specifically in the Custom Scheduled Task Feature. The flaw allows remote attackers to manipulate the customCode argument to perform OS command injection. Although the vendor documents this behavior as intended for debugging, the isSafePhpCode blacklist does not provide sufficient containment to prevent remote code execution. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity. No official fix or patch has been disclosed, and no known exploits are reported in the wild.

An attacker with remote access can exploit this vulnerability to execute arbitrary operating system commands on the affected system. This could lead to unauthorized system control or data compromise. However, the vulnerability is documented by the vendor as debug-only behavior, and the blacklist intended to prevent exploitation is ineffective, increasing the risk of remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor documents this as deliberate debug-only behavior and no official fix is available, users should consider disabling or restricting access to the affected Custom Scheduled Task Feature endpoint until a patch or official mitigation is provided.