CVE-2025-67888
HighSummary
An issue was discovered in Control Web Panel (CWP) before version 0.9.8.1209, where user input passed via the 'key' GET parameter to /admin/index.php is not properly sanitized. This vulnerability allows unauthenticated attackers to inject and execute arbitrary OS commands with root privileges on the web server.
Risk Assessment
The improper sanitization of user input poses a significant security risk, allowing unauthorized attackers to gain control over the server. This could lead to severe consequences, including data loss and system integrity breaches.
Recommendation
It is recommended to update Control Web Panel to the latest version to mitigate this vulnerability. Additionally, implementing input validation and monitoring server activity is advisable.
Other vulnerabilities in Control Web Panel (CWP)
See all- CVE-2026-77876Critical
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module. Unescaped input from the file POST parameter in the acc=deletedp action is passed directly into a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.
- CVE-2026-73696Critical
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex). A missing exit() call after a header('Location: ...') redirect allows unauthenticated attackers to continue PHP execution past the redirect and reach user panel functionality that should require authentication.
Original NVD description (English source)
An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS