What is the CVSS score of CVE-2026-34234?

CVE-2026-34234 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-34234?

CtrlPanel billing software version 1.1.1 and earlier contains a critical unauthenticated remote code execution vulnerability affecting all deployed instances.. A patch is available.

How to fix or mitigate CVE-2026-34234?

WITHIN 24 HOURS: Conduct inventory of all CtrlPanel deployments and identify which instances are internet-facing and running version 1.1.1 or earlier. WITHIN 7 DAYS: Implement emergency network controls-restrict all access to the installer endpoint or isolate the application from untrusted networks; deploy Web Application Firewall rules to block command injection patterns in installer parameters. WITHIN 30 DAYS: Execute migration plan to an alternative billing platform, as no vendor-released patch is available. If migration is delayed, implement continuous endpoint monitoring to detect unexpected process execution and unauthorized outbound connections.

PHP CVE-2026-34234

EUVD-2026-30984 CRITICAL

OS Command Injection (CWE-78)

2026-05-19 GitHub_M

PHP RCE Command Injection

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 19, 2026 - 22:02 EUVD

Source Code Evidence Fetched

May 19, 2026 - 22:00 vuln.today

Analysis Generated

May 19, 2026 - 22:00 vuln.today

DescriptionGitHub Advisory

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.

AnalysisAI

Unauthenticated remote code execution in CtrlPanel billing software (versions 1.1.1 and prior) allows attackers to execute arbitrary OS commands via the web-based installer endpoint, even on already-installed instances. The flaw combines a control-flow bug (install.lock gate runs after handler execution) with command injection through unsanitized user input passed into shell commands. The advisory reports active exploitation in the wild, though no CISA KEV listing is present in the supplied data.