CVE-2025-67888: OS Command Injection
An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67888?
CVE-2025-67888 has a severity rating of high, with a CVSS score of 7.3.
What type of vulnerability is CVE-2025-67888?
CVE-2025-67888 is classified as an OS Command Injection vulnerability.
How can CVE-2025-67888 be exploited?
CVE-2025-67888 can be exploited by unauthenticated attackers injecting malicious input via the 'key' GET parameter.
What versions of Control Web Panel are affected by CVE-2025-67888?
CVE-2025-67888 affects Control Web Panel versions before 0.9.8.1209.
How do I fix CVE-2025-67888?
To fix CVE-2025-67888, you should update to Control Web Panel version 0.9.8.1209 or later.