CVE-2026-57517

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1225

Description An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. Approximately 896,400 devices worldwide are potentially affected. The issue occurs at the 'user' endpoint through the userRes POST parameter. By exploiting MySQL root privileges, an attacker can use the INTO DUMPFILE command to write a PHP webshell into the web-accessible Roundcube logs directory, resulting in remote code execution as the cwpsvc account and potential full server compromise.

Recommendations Upgrade to version 0.9.8.1225. As a temporary workaround, restrict access to the 'user' endpoint or avoid using the userRes parameter until the update is applied.