CVE-2026-77876

CRITICAL 9.8

Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.

CWE	CWE-78
Vendor	control web panel
Product	control web panel
Published	Nov 2, 2026
Last Updated	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for control web panel control web panel

Be the first to know when new critical vulnerabilities affecting control web panel control web panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Control Web Panel / Control Web Panel

0 < 1.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

control-webpanel.com: https://control-webpanel.com/changelog vulncheck.com: https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory

Credits

Valentin Lobstein (Chocapikk)