CVE-2026-77876: Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

Q: Which deployments are affected?

Control Web Panel versions before webpanel_version 1.16 are affected where the protected_directory user panel module is available.

Q: What does an attacker need to exploit this issue?

An attacker needs access sufficient to use the user panel and submit a request to the acc=deletedp action. Exploitation uses attacker-controlled input in the file POST parameter.

Q: What level of access can exploitation provide?

Successful exploitation can execute arbitrary operating-system commands in the user panel context, with high confidentiality, integrity, and availability impact.

Q: How can I determine whether my instance is vulnerable?

Check the installed CWP webpanel_version. Versions earlier than 1.16 are affected.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shellexec call, to achieve code execution in the user panel context.

Event History

Nov 2, 2026

CVE Published

via MITRE·03:18 PM

Data Sourced

via MITRE·03:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Control Web Panel versions before webpanel_version 1.16 are affected where the protected_directory user panel module is available.

What does an attacker need to exploit this issue?

An attacker needs access sufficient to use the user panel and submit a request to the acc=deletedp action. Exploitation uses attacker-controlled input in the file POST parameter.

What level of access can exploitation provide?

Successful exploitation can execute arbitrary operating-system commands in the user panel context, with high confidentiality, integrity, and availability impact.

How can I determine whether my instance is vulnerable?

Check the installed CWP webpanel_version. Versions earlier than 1.16 are affected.

CVE-2026-77876: Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What level of access can exploitation provide?

How can I determine whether my instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What level of access can exploitation provide?

How can I determine whether my instance is vulnerable?