CVE-2026-124020 · Other
NO FIX YET · SEE WHAT TO DO
Control Web Panel (CWP) before webpanel_version 1.30.6 builds password-reset links from the HTTP Host header, so an attacker can make a reset link point to their own server. A mail scanner that opens the poisoned link leaks the live recovery token, which lets the attacker set a new password and then run commands as the hosting account through the File Manager and Crontab modules.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any server running Control Web Panel before webpanel_version 1.30.6 with its password-recovery route reachable from the internet is exposed. Servers that are not running CWP, or that keep the panel off the public internet, face much less risk.
Not affected if panel-not-internet-exposed, webpanel-1.30.6-or-later
Who cares control-web-panel, hosting, linux, self-hosted
1.30.6 are in the stated rangewebpanel_version 1.30.6 or laterControl Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.