Control Web Panel CVE-2026-104080

The attacker must be able to send HTTP requests to the CWP loopback API endpoint /valid_token/, which is bound to the local loopback interface (hence CVSS AV:L) - this means local access to the host or an intermediary that reaches 127.0.0.1 (e.g., an SSRF primitive, a misconfigured reverse proxy, or a co-tenant process), not direct Internet access to the route. Once reachable, no authentication is enforced on the route (PR:N) and no user interaction is needed (UI:N); the attacker simply supplies shell metacharacters in the 'user' parameter, which is passed unescaped into shell_exec(). Limiting factors: exploitation is gated on reaching the loopback-bound endpoint, and hosts running webpanel_version 1.30 or later are not affected.

Signals point in two directions that must be reconciled. On the severity side, this is an unvalidated OS command injection (CWE-78) reaching a shell_exec() call that runs as root, yielding full compromise of the host - the CVSS 4.0 vector confirms maximal vulnerable-system impact (VC:H/VI:H/VA:H) with low complexity (AC:L) and no privileges or user interaction (PR:N/UI:N), producing a base score of 8.6. On the exploitability side, the single most important limiter is AV:L: the vulnerable /valid_token/ endpoint is explicitly described as a LOOPBACK API, so the attacker must already be able to reach 127.0.0.1 on the host (local shell, a co-resident process, or a pivot such as SSRF/an exposed proxy) rather than attack it directly across the network. This creates an apparent tension worth stating plainly: the description calls the attacker 'unauthenticated' and says they 'send a crafted request,' which reads like a network vector, but the CVSS vector and the 'loopback API' wording make clear the access is local - unauthenticated here means no credential is checked on the route, NOT that it is internet-reachable. The vuln.today decision label is 'this_week' (not 'act_now'/'emergency'), and there is no EPSS score, no CISA KEV listing, and no confirmed public exploit in the supplied data, all of which argue against treating this as an active mass-exploitation event. Net: a genuinely serious root-RCE primitive that warrants prompt patching (a vendor fix exists), but its real-world priority is tempered by the local attack surface and the absence of exploitation evidence - prioritize it where CWP hosts are multi-tenant or exposed to SSRF/local pivots.

An attacker who can issue requests to the CWP host's loopback interface - for example via local access on a shared/VPS host or by abusing a server-side request forgery or proxy path that reaches 127.0.0.1 - sends a crafted request to the /valid_token/ route with shell metacharacters embedded in the 'user' parameter. Because the parameter is passed unescaped into shell_exec(), the injected command runs as root, giving full host takeover. No public exploit is identified in the supplied data, though a VulnCheck advisory documents the flaw.