{"id":"CVE-2025-48703","kind":"vulnerability","aliases":["CVE-2025-48703"],"related":[],"title":"control-webpanel webpanel: CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via…","description":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"CWP Control Web Panel, a web hosting control panel formerly called CentOS Web Panel, has an OS command injection flaw in the filemanager changePerm request's t_total parameter. An unauthenticated attacker who knows a valid non-root username can run arbitrary shell commands on the server.","severity":"critical","cvss":9.0,"epss":null,"exploited":true,"exploited_at":"2025-11-04T00:00:00+00:00","products":[{"name":"CWP Control Web Panel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"control-webpanel webpanel","fixed":["0.9.8.1205"],"affected":"< 0.9.8.1205","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cwp","exploited","other","self-hosted","web-hosting"],"not_affected_if":["not-cwp-installed"],"how_to_check":null,"fix":"Apply the mitigations from the vendor instructions referenced by CISA; if no mitigation is available, discontinue use of the product.","status":"open","published_at":"2025-09-19T18:15:36+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:23+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:44:23Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor instructions referenced by CISA; if no mitigation is available, discontinue use of the product.\nunknown","reach":"internet","summary":"CWP Control Web Panel, a web hosting control panel formerly called CentOS Web Panel, has an OS command injection flaw in the filemanager changePerm request's t_total parameter. An unauthenticated attacker who knows a valid non-root username can run arbitrary shell commands on the server.","category":"other","who_cares":["cwp","self-hosted","web-hosting"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary OS commands as root on the server.","analyst_note":"Find the vendor advisory and the fixed CWP version via the CISA KEV entry; confirm which versions are affected and the exact mitigation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-cwp-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000445,"input_tokens":2573,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':147C '-2025':23A,26A '-48703':24A,27A '0.9.8.1205':15A '22':146C 'action':137C 'aka':6A 'allow':16A,108C 'appli':138C 'applic':144C 'arbitrari':87B 'attack':76B 'bod':145C 'call':55B 'cento':11A,56B,98C 'changeperm':68B,124C 'cisa':135C 'cloud':150C 'code':19A,111C 'command':62B,89B,104C 'contain':101C 'control':2A,7A,29A,33A,46B,52B,94C 'control-webpanel':1A,32A 'cve':22A,25A 'cwp':5A,28A,36B,45B,93C 'discontinu':153C 'execut':20A,112C 'exploit':37B 'filemanag':67B,123C 'flaw':64B 'follow':143C 'former':54B,97C 'guidanc':148C 'host':41B,44B,51B 'inject':63B,105C 'instruct':142C 'know':78B 'known':134C 'metacharact':115C 'mitig':139C,159C 'must':132C 'non':82B,129C 'non-root':81B,128C 'os':61B,103C 'panel':9A,13A,31A,48B,53B,58B,96C,100C 'paramet':73B,120C 'per':140C 'product':157C 'remot':18A,110C 'request':69B,125C 'requir':136C 'root':83B,130C 'run':86B 'self':40B 'self-host':39B 'server':92B 'servic':151C 'shell':88B,114C 'total':72B,119C 'unauthent':17A,75B,109C 'unavail':161C 'use':154C 'usernam':84B,131C 'valid':80B,127C 'vendor':141C 'via':21A,113C 'vulner':106C 'web':8A,12A,30A,43B,47B,50B,57B,95C,99C 'web-host':42B 'webpanel':3A,4A,34A,35A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-19T18:15:36+00:00","kev":{"dateAdded":"2025-11-04","dueDate":"2025-11-25","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-48703","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48703","severity":null,"published_at":"2025-11-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-48703","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48703","severity":null,"published_at":"2025-09-19T18:15:36+00:00","modified_at":"2026-06-17T09:30:12+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}