{"id":"CVE-2026-77876","kind":"vulnerability","aliases":["CVE-2026-77876"],"related":[],"title":"Control Web Panel: unescaped file parameter lets users run OS commands","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.","summary":"Control Web Panel (CWP) versions before webpanel_version 1.16 pass the file POST parameter of the acc=deletedp action straight into a shell call without escaping. An attacker who can reach the user panel can run arbitrary operating system commands.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","cwp","linux","runtime","shared-hosting"],"not_affected_if":["webpanel-1.16-or-later"],"how_to_check":"- Check the installed CWP version in the panel or on the server, and compare it with `webpanel_version` 1.16.","fix":"- Control Web Panel: upgrade to `webpanel_version` 1.16 or later.","status":"open","published_at":"2026-11-02T16:17:43+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:18+00:00","updated_at":"2026-11-02T16:26:18+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T16:26:18Z","model":"claude-haiku-5-5","output":{"fix":"- Control Web Panel: upgrade to `webpanel_version` 1.16 or later.","reach":"internet","title":"Control Web Panel: unescaped file parameter lets users run OS commands","impact":"high","summary":"Control Web Panel (CWP) versions before webpanel_version 1.16 pass the file POST parameter of the acc=deletedp action straight into a shell call without escaping. An attacker who can reach the user panel can run arbitrary operating system commands.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["control-web-panel","cwp","shared-hosting","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Arbitrary commands run on the server in the user panel context","analyst_note":"Confirm whether the user panel requires a login before the acc=deletedp request is reachable, and check the vulnlcheck advisory for exploit details and affected version ranges.","how_to_check":"- Check the installed CWP version in the panel or on the server, and compare it with `webpanel_version` 1.16.\n- unknown for other checks; the sources do not say which config or logs would show exploitation.","plain_action":"","needs_analyst":true,"not_affected_if":["webpanel-1.16-or-later"],"who_is_affected":"Servers running Control Web Panel before webpanel_version 1.16 are exposed through the user panel, since the flaw is in the protected_directory module reached by the acc=deletedp action. Attackers need to reach the user panel, so the risk is highest for hosts where user panel access is exposed to the internet. Servers already on 1.16 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000723,"input_tokens":4190,"output_tokens":607,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-77876':14A,17A '1.16':36B,75C 'acc':44B,107C 'achiev':128C 'action':46B,109C 'allow':90C 'arbitrari':64B,94C 'attack':55B,91C,110C,118C 'attacker-control':117C 'call':51B,126C 'code':129C 'command':11A,67B,79C,95C 'contain':76C 'context':135C 'control':1A,19B,28B,68C,119C 'control-web-panel':18B 'cve':12A,15A 'cwp':22B,31B,71C 'deletedp':45B,108C 'direct':121C 'directori':85C 'escap':53B 'exec':125C 'execut':93C,130C 'exploit':112C 'file':5A,39B,102C 'flaw':114C 'host':27B 'inject':80C 'input':99C,120C 'let':7A 'linux':23B 'modul':88C 'oper':65B 'os':10A,78C 'panel':3A,21B,30B,61B,70C,87C,134C 'paramet':6A,41B,104C 'pass':37B,116C 'post':40B,103C 'protect':84C 'reach':58B 'run':9A,63B 'runtim':24B 'share':26B 'shared-host':25B 'shell':50B,124C 'straight':47B 'submit':97C 'system':66B 'unescap':4A,98C 'user':8A,60B,86C,133C 'version':32B,35B,74C 'vulner':81C 'web':2A,20B,29B,69C 'webpanel':34B,73C 'without':52B","nicknames":[],"mitigations":[],"who_affected":"Servers running Control Web Panel before webpanel_version 1.16 are exposed through the user panel, since the flaw is in the protected_directory module reached by the acc=deletedp action. Attackers need to reach the user panel, so the risk is highest for hosts where user panel access is exposed to the internet. Servers already on 1.16 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","critical","cwp","linux","runtime","sharedhosting"],"first_public_at":"2026-11-02T16:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77876","severity":null,"published_at":"2026-11-02T16:17:43+00:00","modified_at":"2026-11-02T16:17:43+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null}],"documents":[{"id":52771,"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}