CVE-2026-72589

CVE-2026-72589 in crontab-ui exposes a fundamental design failure: the import feature treats database files as trustworthy artifacts when they are untrusted external input deserving the same scrutiny as any user-supplied data. The vulnerability lives at the intersection of deserialization and command scheduling — a .db file isn't just data, it's a serialized specification of commands the system will execute on its own cron schedule. When /import accepts an arbitrary .db file and overwrites the application database without authentication, an attacker controls what the system will run, when, and how often. The severity is compounded by SQLite's capabilities beyond simple cron entry injection. A crafted .db file can contain triggers, virtual tables, or user-defined functions that execute during the import process itself — not waiting for a scheduled cron run, but executing immediately when the database is attached and parsed. This widens the detonation window but doesn't change the blast radius: arbitrary system command execution either during import or on the subsequent cron schedule produces equivalent impact. The underlying mental model mismatch is critical. The developer built this feature for local backup and restore — a workflow where the operator is the same person who created the file. That assumption collapses the moment the endpoint is network-accessible. This tool sits in a class of developer utilities (phpMyAdmin, adminer, similar web-based config interfaces) designed for localhost single-user operation behind authentication, yet frequently deployed exposed without any hardening because operators treat them as

Reviewed through automated stages and approved by a human before publication.