Live › vulnerability › CVE-2026-77878
Control Web Panel (CWP) before webpanel_version 1.30 passes a file path from a POST request straight into a shell command in its database restore route. An attacker who can reach that route can run arbitrary operating system commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before webpanel_version 1.30 are exposed. The flaw sits in a loopback API route, so the risk depends on whether an attacker can reach that route from the network or through another local process. Hosts without CWP can skip it.
No product ranges from the sources yet.
webpanel_version below 1.30 is affected/v1/restoredatabase/ is reachable from anywhere other than the local machinewebpanel_version 1.30 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.
This page as .md · .json · in your agent: get_signal("CVE-2026-77878")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.