Live › vulnerability › CVE-2026-77876
Control Web Panel (CWP) versions before webpanel_version 1.16 pass the file POST parameter of the acc=deletedp action straight into a shell call without escaping. An attacker who can reach the user panel can run arbitrary operating system commands.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before webpanel_version 1.16 are exposed through the user panel, since the flaw is in the protected_directory module reached by the acc=deletedp action. Attackers need to reach the user panel, so the risk is highest for hosts where user panel access is exposed to the internet. Servers already on 1.16 or later are not affected.
No product ranges from the sources yet.
webpanel_version 1.16.webpanel_version 1.16 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.
This page as .md · .json · in your agent: get_signal("CVE-2026-77876")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.