Control Web Panel Patches Ten Flaws Allowing Unauthenticated Root Code Execution

TL;DR

VulnCheck researcher Valentin Lobstein disclosed ten security flaws in Control Web Panel (CWP) that chain together for full root access. Tracked from CVE-2026-73695 to CVE-2026-104080, these bugs let an attacker run code as a hosting user and jump to root. Server admins must update to version 1.29 or 1.30 right away to block this attack chain.

Notable CVEs

Why It Matters

Control Web Panel, once known as CentOS Web Panel, manages thousands of web servers around the world. According to the VulnCheck technical advisory, ZoomEye tracks roughly 210,000 hosts on port 2083, while Shodan lists about 23,000 servers. Furthermore, VulnCheck Target Intelligence spots 118,151 service records, including 19,834 panels exposed on the port 2083 user port.

Currently, no active attacks in the wild have been confirmed for these ten flaws. However, a public proof-of-concept exploit tool now exists. Specifically, the VulnCheck team shared a working go-exploit module for CVE-2026-73695 in their public repo. In addition, vendor release notes and NVD records show that past bugs in this panel faced fast mass attacks. When chained together, the entry flaw (CVSS 9.8) and local root bugs (CVSS 8.8) hit a 10.0 score.

How the Attack Works

Pre-Auth Redirect Fallthrough and File Inclusion

First, the attack hits the user panel on port 2083 using one valid hosting account name. Because the server returns a 302 code for real users and a 404 for fake ones, attackers can test names fast. Next, the chain uses CVE-2026-73696, an execution-after-redirect flaw (CWE-698), and CVE-2026-73695, a path traversal file inclusion bug (CWE-98).

As Valentin Lobstein wrote in his report, “A login page has one job, to say no.” He added that “CWP’s user panel says no in the HTTP status line and then keeps working anyway.” When an unauthenticated visitor requests a dashboard page, the server sends a 302 redirect header to the login screen. However, the script lacks an exit() call, so the code keeps running and loads the requested PHP module. Lobstein noted that “The whole thing is one missing keyword wide.”

Unauthenticated Module Sinks

Once the request skips past the login redirect, it reaches internal user modules that have no session checks. Consequently, an attacker can use CVE-2026-73697 in the phpini_editor module to write a webshell to disk. That same module also lets an attacker inject shell commands through an unquoted rm call. Similarly, CVE-2026-77876 allows command injection in the protected_directory module by passing raw POST data into an unquoted sed command.

Both module flaws run attacker commands as the target hosting user on a single web request. Meanwhile, the admin panel on the same server is safe because its code calls exit() after every redirect. Lobstein pointed out that “Same codebase, same author, two doors: one locks, one does not.”

Loopback API Escalation to Root

From the hosting user foothold, the attacker targets the internal user API on 127.0.0.1 port 2302. This local service runs as root and talks to MySQL as the root database user. Due to CVE-2026-77877, several API routes lack token checks (CWE-306).

As a result, a local attacker can use CVE-2026-77878 on the /v1/restoredatabase/ route to pass a file name into a root shell. Likewise, CVE-2026-104080 allows root command injection on the tokenless /v1/valid_token/ route through an unquoted grep call. Alternatively, an attacker can use CVE-2026-77879 to inject a SQL UNION string into the access_token() gate and bypass login checks. From there, CVE-2026-77880 runs root commands via the /v1/newpass/ passwd route, while CVE-2026-77881 allows blind database reads as MySQL root.

Affected Versions

These ten flaws affect Control Web Panel builds before version 1.29. VulnCheck tested the full exploit chain on CWP7 webpanel build 1.8 running on AlmaLinux 9. They unpacked the ionCube-encoded PHP files to inspect the raw source code. Any build before version 1.12 exposes the full pre-auth root chain over the network.

Furthermore, builds from 1.12 through 1.27 remain open to local root takeover. Version 1.12 added the missing exit() call to stop pre-auth entry. However, the local user API stayed open until versions 1.27 and 1.29. Therefore, any logged-in hosting user on builds below 1.29 can still take full root control of the server.

Patch and Mitigation Steps

The vendor fixed all ten bugs across staged updates ending in Control Web Panel version 1.29 on October 31, 2026. Specifically, version 1.12 added the exit() call after login redirects. Next, version 1.16 cleaned module names and removed raw shell calls. Finally, versions 1.27 and 1.29 added session checks, input allow-lists, and runuser limits on the port 2302 local API.

Admins should update their servers to version 1.29 or the current 1.30 release right away. In addition, security teams should block public internet access to the user panel on port 2083. They should also restrict the admin panel on ports 2031 and 2087. Putting these control ports behind a strict IP allow-list or VPN stops outside attackers from reaching the panel.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.