{"id":"CVE-2026-77878","published":"2026-11-02T16:17:43.640","lastModified":"2026-11-02T19:35:33.347","description":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Control Web Panel (CWP) before version 1.30 contains an OS command injection flaw in the /v1/restoredatabase/ endpoint, where an attacker-supplied file path is passed unsanitized to a shell command during database restoration, enabling arbitrary command execution as root.","exploitability":"Low-privilege local access to the loopback API route is sufficient; no authentication or user interaction required.","blast_radius":"Successful exploitation grants full root-level compromise of the host, allowing complete data exfiltration, system modification, or lateral movement.","remediation":"Upgrade to CWP webpanel_version 1.30 or later, which patches the command injection in the restoreDBBackup() handler.","detection":"Look for POST requests to /v1/restoredatabase/ with suspicious file paths containing shell metacharacters (e.g., semicolons, backticks, $()) in CWP access logs; additionally, monitor for unexpected root-level process spawns or file writes triggered by web server processes.","tags":["os-command-injection","webapp","privilege-escalation","cwp","loopback-api"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:02:14.075Z"}}