OS Command Injection Vulnerability in Control Web Panel by Control Web Panel
CVE-2026-104080

8.6HIGH

Key Information:

Vendor

Control Web Panel

Status
Control Web Panel
Vendor
CVE Published:
2 November 2026

What is CVE-2026-104080?

Control Web Panel (CWP) before version 1.30 is susceptible to an OS command injection vulnerability within the /valid_token/ API route. This flaw enables unauthenticated attackers to execute arbitrary commands with root privileges by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send specially crafted requests to the /valid_token/ route, leading to potential system compromise through the mishandling of parameters passed to a shell_exec() call.

Affected Version(s)

Control Web Panel 0 < 1.30

References

https://control-webpanel.com/changelog
release-notespatch
https://www.vulncheck.com/advisories/control-web-panel-cw...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.