# CVE-2020-10221: rConfig - RCE

> Live exploitation tracking for CVE-2020-10221 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-10221

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** rConfig
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** management_panel, web_application

## Description

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

## CrowdSec analysis

[CVE-2020-10221](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-10221) is a high-severity command injection vulnerability in rConfig through version 3.94 that allows authenticated remote attackers to execute arbitrary operating system commands through shell metacharacters in the fileName parameter. Successful exploitation could result in unauthorized access to sensitive data, system modification, and complete compromise of the affected server.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2020-10221 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers authenticate through `/lib/crud/userprocess.php` and target `/lib/ajaxHandlers/ajaxAddTemplate.php` with a `fileName` parameter containing shell metacharacters and a time-delay command, such as `;sleep 7;`, to inject and execute arbitrary operating-system commands.

## Timeline

- 2020-03-08: CVE Published. CVE-2020-10221 is published to NVD.
- 2021-11-03: CISA KEV. CVE-2020-10221 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-05-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-09-17: Rule Released. CrowdSec releases a rule to detect CVE-2020-10221 exploitation attempts against the CrowdSec Network.

## References

- https://cwe.mitre.org/data/definitions/78.html
- http://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10221
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10221.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-10221) follows observed exploitation activity for CVE-2020-10221. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.