{"id":"CVE-2026-77876","published":"2026-11-02T16:17:43.293","lastModified":"2026-11-02T19:35:33.347","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Control Web Panel (CWP) before version 1.16 has an OS command injection flaw in its protected_directory module where unescaped user input from the 'file' POST parameter is passed directly to shell_exec during the 'acc=deletedp' action, enabling remote code execution as the web application user.","exploitability":"Exploitation is straightforward for unauthenticated attackers due to the lack of authentication, input sanitization, or output encoding on the vulnerable endpoint.","blast_radius":"Successful exploitation allows full compromise of the affected system within the context of the web server user, potentially leading to data theft, system modification, or lateral movement.","remediation":"Upgrade to CWP version 1.16 or later, which includes a fix for this vulnerability.","detection":"Look for shell_exec calls in PHP logs with suspicious 'file' POST parameter values containing shell metacharacters (e.g., ;, |, &, $(), backticks) during requests to the protected_directory endpoint with acc=deletedp; also monitor web server access logs for such patterns.","tags":["os-command-injection","rce","webapp","cwp","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:54:49.690Z"}}