CVE-2026-104080

Summary

Control Web Panel (CWP) before version 1.30 contains an OS command injection flaw in its /valid_token/ loopback API endpoint, where unauthenticated attackers can inject shell metacharacters into the 'user' parameter, causing arbitrary commands to execute as root via unsanitized use of shell_exec().

Exploitability

Exploitation is trivial for unauthenticated attackers due to lack of input validation and authentication on the vulnerable endpoint.

Blast radius

Successful exploitation grants full root-level compromise of the host, enabling complete data theft, system modification, or lateral movement within the server environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to CWP webpanel_version 1.30 or later, which patches the OS command injection in the /valid_token/ route.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.