Control Web Panel CVE-2026-57517

No special conditions - remote unauthenticated exploitation against default configurations of Control Web Panel prior to 0.9.8.1225, reachable over the network via the user endpoint's userRes POST parameter (AV:N/AC:L/PR:N/UI:N). The RCE escalation specifically requires that CWP's MySQL connection holds root/FILE privileges (its default) and that the roundcube logs directory is web-accessible and served by PHP; the injection itself works regardless. Limiting factors: the target CWP panel/HTTP interface must be network-reachable by the attacker, and the file-write-to-RCE step depends on the default root MySQL privilege and writable web-served log path remaining intact.

All signals align toward high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, base 9.3) describes remote, unauthenticated, low-complexity exploitation with full confidentiality/integrity/availability impact, and the description confirms a realistic chain from injection to RCE. VulnCheck reporting plus publicly available exploit code (KIS-2026-12) means weaponization risk is immediate rather than theoretical. No EPSS score and no CISA KEV entry were provided in the input, so active-exploitation status is unconfirmed - the current evidence is 'publicly available exploit code exists,' which is distinct from confirmed in-the-wild use. The main mitigating factor is prevalence: CWP is a niche hosting-panel product rather than ubiquitous infrastructure, so exploitation is likely opportunistic against exposed panels rather than universal.

An attacker locates an internet-exposed CWP panel and sends a crafted POST request to the user endpoint with a malicious payload in the userRes parameter, blindly extracting or manipulating data via the root-privileged MySQL connection. Using INTO DUMPFILE, they write a PHP webshell to the roundcube logs directory and request it over HTTP, gaining command execution as cwpsvc. Publicly available exploit code (KIS-2026-12) makes this chain readily reproducible without prior authentication or user interaction.