What is the CVSS score of CVE-2025-48703?

CVE-2025-48703 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 59.1%.

Which versions of Webpanel are affected by CVE-2025-48703?

CVE-2025-48703 presents critical security risk, a OS command injection vulnerability rated CVSS 9.0.

Is there a public PoC exploit available for CVE-2025-48703?

Yes, a public proof-of-concept exploit is available for CVE-2025-48703. Prioritise patching immediately. EPSS: 59.1%.

How to fix or mitigate CVE-2025-48703?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Webpanel CVE-2025-48703

CRITICAL

OS Command Injection (CWE-78)

2025-09-19 cve@mitre.org

RCE Command Injection Webpanel Control Webpanel

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:13 vuln.today

Added to CISA KEV

Nov 05, 2025 - 14:07 cisa

CISA KEV

PoC Detected

Nov 05, 2025 - 14:07 vuln.today

Public exploit code

CVE Published

Sep 19, 2025 - 18:15 nvd

CRITICAL 9.0

DescriptionCVE.org

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

AnalysisAI

CentOS Web Panel (CWP) allows unauthenticated remote code execution through OS command injection in the filemanager changePerm request's t_total parameter.

Technical ContextAI

The CWE-78 command injection in the filemanager's changePerm CGI passes the t_total parameter to a shell command without sanitization, enabling arbitrary command execution.