CVE-2026-77876

Control Web Panel (CWP) before webpanel version 1.16 contains an OS command injection vulnerability in the protected directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell exec call, to achieve code execution in the user panel context.