rConfig - RCE (CVE-2020-10221)

CVE-2020-10221 is a high-severity command injection vulnerability in rConfig through version 3.94 that allows authenticated remote attackers to execute arbitrary operating system commands through shell metacharacters in the fileName parameter. Successful exploitation could result in unauthorized access to sensitive data, system modification, and complete compromise of the affected server.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2020-10221 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers authenticate through /lib/crud/userprocess.php and target /lib/ajaxHandlers/ajaxAddTemplate.php with a fileName parameter containing shell metacharacters and a time-delay command, such as ;sleep 7;, to inject and execute arbitrary operating-system commands.