Live › vulnerability › CVE-2026-104080
Control Web Panel (CWP) before webpanel_version 1.30 passes the 'user' parameter of its loopback /valid_token/ API route unescaped into a shell call. An unauthenticated attacker who can reach that route can inject shell metacharacters and run arbitrary commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before version 1.30 are exposed. The flaw is in a loopback-only API route, so the risk depends on whether an attacker can reach that route, directly or through a proxy or local foothold; the sources do not say which configurations expose it further.
No product ranges from the sources yet.
webpanel_version in the panel's version file; versions below 1.30 are affected per the sources./valid_token/ is reachable from outside the host, such as through a proxy or forwarded port.webpanel_version 1.30 or later, as stated by the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.
This page as .md · .json · in your agent: get_signal("CVE-2026-104080")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.