CVE-2026-85040: ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Vendor documents this as deliberate debug-only behavior. But isSafePhpCode blacklist offers no real RCE containment.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
ZhongBangKeJi CRMEB deployments running version 6.0.0 or earlier should be reviewed, particularly where the Custom Scheduled Task Feature is available.
What level of attacker access is required?
The reported vector requires high privileges, but exploitation can be initiated remotely and does not require user interaction.
How should the documented debug-only status affect triage?
The vendor describes the behavior as deliberate debug-only functionality. However, the isSafePhpCode blacklist is reported not to provide meaningful containment against remote code execution, and a public exploit is available.