Threats affecting pkg:rpm/clearfoundation/clearos

ClearOS 7.9 contains an OS command injection vulnerability in its Log Viewer component. Authenticated attackers can exploit this flaw by submitting unsanitized input through the filter parameter, which is directly used in a shell command. This allows execution of arbitrary commands as the webconfig user. Because the webconfig user has extensive NOPASSWD sudo privileges by default, attackers can escalate privileges to root immediately. The vulnerability has a high severity score of 8.6 CVSS 4.0. No official patch or remediation guidance is currently available.