CVE-2026-77880: Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Q: Who can exploit this issue?

An attacker needs the ability to send a POST request to the loopback API password-change route at /newpass/ and manipulate the user parameter. The provided data does not state whether authentication is required or how the loopback API is exposed.

Q: What is the impact of successful exploitation?

Injected commands are executed as root, allowing arbitrary command execution with root privileges. This can affect confidentiality, integrity, and availability.

Q: Which installations are affected?

Control Web Panel versions before webpanel_version 1.16 are affected. The data does not identify a specific default configuration or deployment condition beyond the presence of the vulnerable loopback API route.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.

Event History

Nov 2, 2026

CVE Published

via MITRE·03:21 PM

Data Sourced

via MITRE·03:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the ability to send a POST request to the loopback API password-change route at /newpass/ and manipulate the user parameter. The provided data does not state whether authentication is required or how the loopback API is exposed.

What is the impact of successful exploitation?

Injected commands are executed as root, allowing arbitrary command execution with root privileges. This can affect confidentiality, integrity, and availability.

Which installations are affected?

Control Web Panel versions before webpanel_version 1.16 are affected. The data does not identify a specific default configuration or deployment condition beyond the presence of the vulnerable loopback API route.

CVE-2026-77880: Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which installations are affected?