CVE-2026-77878

Summary

Control Web Panel (CWP) before version 1.30 contains an OS command injection flaw in the /v1/restoredatabase/ endpoint, where an attacker-supplied file path is passed unsanitized to a shell command during database restoration, enabling arbitrary command execution as root.

Exploitability

Low-privilege local access to the loopback API route is sufficient; no authentication or user interaction required.

Blast radius

Successful exploitation grants full root-level compromise of the host, allowing complete data exfiltration, system modification, or lateral movement.

Detection

Look for POST requests to /v1/restoredatabase/ with suspicious file paths containing shell metacharacters (e.g., semicolons, backticks, $()) in CWP access logs; additionally, monitor for unexpected root-level process spawns or file writes triggered by web server processes.

Prioritized remediation

Upgrade to CWP webpanel_version 1.30 or later, which patches the command injection in the restoreDBBackup() handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.