Loading vulnerability…
OS command injection in Control Web Panel protected_directory module
CVE-2026-77876 is an operating-system command injection vulnerability in Control Web Panel (CWP) before webpanel_version 1.16. The protected_directory user-panel module passes unescaped input from the file POST parameter in the acc=deletedp action directly to shell_exec, allowing arbitrary command execution under the hosting account's operating-system identity. The module relies on the dispatcher for authentication. On versions with vulnerable pre-authentication dispatch, attackers can combine this flaw with CVE-2026-73695 and CVE-2026-73696 to obtain unauthenticated command execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of resources accessible to the affected hosting account, allowing data disclosure, file modification, and service disruption through arbitrary operating-system commands. This vulnerability alone does not establish root execution. Separate vulnerabilities in CWP's root-owned loopback user API can be chained with hosting-account command execution to escalate to root.
If you can’t patch tonight, do this now.
Restrict access to the user panel on port 2083 using network allow-lists; similarly restrict administrative-panel ports 2031 and 2087 wherever possible. CWP 1.12 introduced session enforcement before module inclusion, blocking the demonstrated unauthenticated entry path, but it does not fix this command injection and is not a substitute for upgrading to a fixed release.
Patch, then assume compromise.
Upgrade to webpanel_version 1.16 or later to fix this vulnerability. Prefer CWP 1.29 or later, which also addresses the other disclosed user-panel and user-API vulnerabilities that enable unauthenticated entry and root escalation.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.