CVE-2026-90492: webgjc web_robot web.py controller_recover os command injection
A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered affected?
Deployments of webgjc web_robot version 2.4.0, 2.5.0, or 2.8.0 should be considered affected where the controller_listen or controller_recover functionality in py/web.py is reachable.
What access does an attacker need?
The issue can be initiated remotely and does not require privileges. The published severity vector indicates user interaction is required.
How urgent is remediation?
A public exploit has been disclosed and may be used. The vendor was contacted but did not respond, so organizations should not assume a vendor fix or guidance is available.