---
id: "CVE-2022-44877"
kind: "vulnerability"
aliases: ["CVE-2022-44877"]
title: "control-webpanel webpanel: login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "CWP Control Web Panel", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "control-webpanel webpanel", "fixed": ["0.9.8.1147"], "affected": "< 0.9.8.1147", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cwp", "exploited", "linux", "other", "self-hosted"]
not_affected_if: ["not-cwp-installed"]
published_at: "2023-01-05T23:15:09+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-44877", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44877", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# control-webpanel webpanel: login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to…

CWP Control Web Panel (formerly CentOS Web Panel), a server control panel, has an OS command injection flaw in its login parameter. A remote attacker can run arbitrary operating system commands on the server by putting shell metacharacters in that field.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CWP Control Web Panel affected ? fixed ?
- vendor:control-webpanel webpanel affected < 0.9.8.1147 fixed 0.9.8.1147

## Fix

Apply the vendor update for CWP Control Web Panel per vendor instructions; the affected and fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-44877
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-44877

## From the sources

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_