CVE-2026-77876

Summary

Control Web Panel (CWP) before version 1.16 has an OS command injection flaw in its protected_directory module where unescaped user input from the 'file' POST parameter is passed directly to shell_exec during the 'acc=deletedp' action, enabling remote code execution as the web application user.

Exploitability

Exploitation is straightforward for unauthenticated attackers due to the lack of authentication, input sanitization, or output encoding on the vulnerable endpoint.

Blast radius

Successful exploitation allows full compromise of the affected system within the context of the web server user, potentially leading to data theft, system modification, or lateral movement.

Detection

Look for shell_exec calls in PHP logs with suspicious 'file' POST parameter values containing shell metacharacters (e.g., ;, |, &, $(), backticks) during requests to the protected_directory endpoint with acc=deletedp; also monitor web server access logs for such patterns.

Prioritized remediation

Upgrade to CWP version 1.16 or later, which includes a fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.