CVE-2026-77876
Received Received - Intake

OS Command Injection in Control Web Panel

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-77876

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Control Web Panel Control Web Panel 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Control Web Panel (CWP) before version 1.16 has an OS command injection flaw in the protected_directory user panel module. Attackers can execute arbitrary commands by sending unescaped input through the file POST parameter in the acc=deletedp action. The input is passed directly into a shell_exec call, allowing code execution within the user panel context.

Detection Guidance

To detect this vulnerability, check if your Control Web Panel (CWP) version is below 1.16. Inspect the protected_directory user panel module for unescaped input in the file POST parameter during the acc=deletedp action. Look for suspicious shell_exec calls or unexpected command execution in logs.

Impact Analysis

This vulnerability allows attackers to run arbitrary commands on the server hosting CWP. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. Attackers could install malware, modify or delete files, or pivot to other systems in the network.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines, legal penalties, and reputational damage due to non-compliance if this flaw is exploited.

Mitigation Strategies

Immediately update Control Web Panel to version 1.16 or later to patch the OS command injection flaw. Disable or restrict access to the protected_directory user panel module if an update is not immediately available. Monitor system logs for signs of exploitation and restrict shell access for the web panel user.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...