PT-2026-135493
CVE-2026-77878
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
8.4
HighMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Control Web Panel (CWP) before webpanel version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾