CVE-2026-104080: Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token

Q: Which systems are exposed to this issue?

Control Web Panel installations running a version before webpanel_version 1.29 are affected if the loopback API /valid_token/ route can be reached by an attacker. The vulnerable route executes commands as root.

Q: Does an attacker need credentials or user interaction?

No. The issue is described as exploitable by unauthenticated attackers, with no user interaction required. A crafted request injects shell metacharacters through the user parameter.

Q: What is the remediation?

Upgrade Control Web Panel to webpanel_version 1.29 or later. The provided data does not specify an alternative mitigation for environments where upgrading cannot happen immediately.

Q: How can I determine whether my installation is affected?

Check the installed Control Web Panel webpanel_version. Versions earlier than 1.29 are affected; the provided data does not include indicators of compromise or detection guidance.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /validtoken/ route, which passes the parameter unescaped into a shellexec() call.

Event History

Nov 2, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

Control Web Panel installations running a version before webpanel_version 1.29 are affected if the loopback API /valid_token/ route can be reached by an attacker. The vulnerable route executes commands as root.

Does an attacker need credentials or user interaction?

No. The issue is described as exploitable by unauthenticated attackers, with no user interaction required. A crafted request injects shell metacharacters through the user parameter.

What is the remediation?

Upgrade Control Web Panel to webpanel_version 1.29 or later. The provided data does not specify an alternative mitigation for environments where upgrading cannot happen immediately.

How can I determine whether my installation is affected?

Check the installed Control Web Panel webpanel_version. Versions earlier than 1.29 are affected; the provided data does not include indicators of compromise or detection guidance.

CVE-2026-104080: Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction?

What is the remediation?

How can I determine whether my installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction?

What is the remediation?

How can I determine whether my installation is affected?