CVE-2026-77878

HIGH 8.4

Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API

CVSS Score

8.4

EPSS Score

0.0%

EPSS Percentile

0th

Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.

CWE	CWE-78
Vendor	control web panel
Product	control web panel
Published	Nov 2, 2026
Last Updated	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for control web panel control web panel

Be the first to know when new high vulnerabilities affecting control web panel control web panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Control Web Panel / Control Web Panel

0 < 1.30

References

NVD ↗ CVE.org ↗ EPSS Data ↗

control-webpanel.com: https://control-webpanel.com/changelog vulncheck.com: https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api

Credits

Valentin Lobstein (Chocapikk)