Critical SQL Injection in Control Web Panel Enables Unauthenticated RCE
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 6, 2026
A critical blind SQL injection flaw tracked as CVE-2026-57517 affects Control Web Panel versions <= 0.9.8.1224 through the userRes POST parameter on the user endpoint. Public disclosure says the bug can be exploited remotely without authentication, although an attacker may need to know or guess a valid non-root username on the target instance. The issue carries a CVSS v3.1 score of 9.8 and allows arbitrary SQL execution against the backend database with MySQL root privileges.
The disclosed attack path shows the database access can be escalated into arbitrary file write using MySQL features such as INTO DUMPFILE, allowing a PHP webshell to be written into a web-accessible Roundcube logs directory and resulting in remote code execution as the cwpsvc account. The vulnerability was disclosed by Egidio Romano, and the vendor has fixed it in Control Web Panel 0.9.8.1225; administrators are being urged to upgrade immediately and apply the vendor's security updates.
