CVE-2026-77876
CriticalCVSS 9.8Summary
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module. Unescaped input from the file POST parameter in the acc=deletedp action is passed directly into a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.
Risk Assessment
An attacker can execute arbitrary OS commands with the privileges of the panel process, potentially leading to server takeover or data theft. Exploitation only requires access to the protected_directory module of the user panel.
Recommendation
Upgrade Control Web Panel to version 1.16 or later. Until patched, restrict access to the protected_directory module and review logs for suspicious requests to the acc=deletedp action.
Other vulnerabilities in Control Web Panel (CWP)
See all- CVE-2025-67888High
An issue was discovered in Control Web Panel (CWP) before version 0.9.8.1209, where user input passed via the 'key' GET parameter to /admin/index.php is not properly sanitized. This vulnerability allows unauthenticated attackers to inject and execute arbitrary OS commands with root privileges on the web server.
- CVE-2026-73696Critical
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex). A missing exit() call after a header('Location: ...') redirect allows unauthenticated attackers to continue PHP execution past the redirect and reach user panel functionality that should require authentication.
Original NVD description (English source)
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS