OS Command Injection Vulnerability in Control Web Panel by Control Web Panel
CVE-2026-77878

8.6HIGH

Key Information:

Vendor

Control Web Panel

Status
Control Web Panel
Vendor
CVE Published:
2 November 2026

What is CVE-2026-77878?

An OS command injection vulnerability exists in Control Web Panel (CWP) versions prior to 1.30 through the /v1/restoredatabase/ route of the loopback API. The restoreDBBackup() handler inadequately sanitizes an attacker-controlled file path from the POST request's body, enabling the potential execution of arbitrary OS commands with root privileges. Attackers exploiting this vulnerability can compromise the system environment by injecting malicious commands, leading to unauthorized access and control.

Affected Version(s)

Control Web Panel 0 < 1.30

References

https://control-webpanel.com/changelog
release-notespatch
https://www.vulncheck.com/advisories/control-web-panel-cw...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.