CVE-2026-77878: Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API

Q: What access does an attacker need to exploit this issue?

The attacker must be able to reach the loopback API database restore route at /v1/restoredatabase/ and submit a crafted file path in the POST body.

Q: What is the impact of successful exploitation?

A crafted file path can inject arbitrary operating-system commands into the restoreDBBackup() handler. The injected commands execute as root.

Q: How can I determine whether my CWP installation is affected?

Installations with a webpanel_version earlier than 1.29 are affected. The vulnerable code is associated with the database restore API route /v1/restoredatabase/.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.

Event History

Nov 2, 2026

CVE Published

via MITRE·03:19 PM

Data Sourced

via MITRE·03:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be able to reach the loopback API database restore route at /v1/restoredatabase/ and submit a crafted file path in the POST body.

What is the impact of successful exploitation?

A crafted file path can inject arbitrary operating-system commands into the restoreDBBackup() handler. The injected commands execute as root.

How can I determine whether my CWP installation is affected?

Installations with a webpanel_version earlier than 1.29 are affected. The vulnerable code is associated with the database restore API route /v1/restoredatabase/.

CVE-2026-77878: Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

How can I determine whether my CWP installation is affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

How can I determine whether my CWP installation is affected?