CVE-2026-77878 — Vulnerability intelligence

Control Web Panel — Control Web Panel

Published: 2026-11-02T15:19:59.230Z

CVSS

8.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.

Sources

• CVE-2026-77878
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-77878