CVE-2025-48703: CWP Control Web Panel OS Command Injection Vulnerability
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known.
Other sources
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CWP (Control Web Panel / CentOS Web Panel)to a version that resolves this vulnerability.Fixed in 0.9.8.1205 - Compensating control
Follow applicable BOD 22-01 guidance for cloud services; discontinue use of the product if mitigations are unavailable.
- Operational
A valid non-root username must be known.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48703?
CVE-2025-48703 is classified as a critical vulnerability due to its ability to facilitate unauthenticated remote code execution.
How do I fix CVE-2025-48703?
To fix CVE-2025-48703, update Control Web Panel to version 0.9.8.1205 or later.
What software is affected by CVE-2025-48703?
CVE-2025-48703 affects Control Web Panel (CWP) versions prior to 0.9.8.1205.
What kind of attack can CVE-2025-48703 facilitate?
CVE-2025-48703 allows an attacker to execute arbitrary commands on the server remotely without authentication.
Is user authentication required to exploit CVE-2025-48703?
Exploitation of CVE-2025-48703 requires knowledge of a valid non-root username, but does not require authentication.