CVE-2026-77880

HIGH 8.4

Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

CVSS Score

8.4

EPSS Score

0.0%

EPSS Percentile

0th

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.

CWE	CWE-78
Vendor	control web panel
Product	control web panel
Published	Nov 2, 2026
Last Updated	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for control web panel control web panel

Be the first to know when new high vulnerabilities affecting control web panel control web panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Control Web Panel / Control Web Panel

0 < 1.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

control-webpanel.com: https://control-webpanel.com/changelog vulncheck.com: https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass

Credits

Valentin Lobstein (Chocapikk)