CVE-2020-29390: Zeroshell

Critical severity, CVSS 9.8. EPSS: 39.6% chance of exploitation in the next 30 days.

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.

Affected products

• Zeroshell Zeroshell: version 3.9.3 only

Published 2020-11-30. Last modified 2026-06-17.