Control Web Panel CVE-2026-77876

Exploitation requires sending an HTTP POST request to the Control Web Panel protected_directory user-panel module invoking the acc=deletedp action with a malicious file parameter containing shell metacharacters; that value is passed directly into a shell_exec call. Per the CVSS PR:N/UI:N vector and the VulnCheck pre-auth module-dispatch finding, no authentication or user interaction is required against default installations of CWP before webpanel_version 1.16. The practical limiting factors are: the CWP user-panel endpoint must be network-reachable to the attacker, and the instance must be running a version prior to 1.16 (patched builds remove the injection). Resulting commands execute in the user panel context, so the effective privilege level on the host should be confirmed against the vendor advisory.

Multiple signals converge on genuine priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H), scoring 9.3 - and the vendor-reported mechanism (attacker-controlled POST input passed directly into a shell_exec call) is consistent with that trivially-exploitable profile. The vuln.today decision label is act_now, and the issue was reported by VulnCheck with a dedicated advisory and a blog describing pre-authentication module-dispatch RCE, reinforcing the PR:N (unauthenticated) reading. Note one point to verify: the description states execution occurs 'in the user panel context,' which can read as a lower-privilege context, while the vector and the referencing blog title assert pre-auth reach - this is a context-of-execution nuance, not an authentication contradiction, but operators should confirm the resulting privilege level with the vendor advisory. No EPSS score and no CISA KEV entry are present in the input, so widespread or confirmed active exploitation cannot be asserted; the act_now label and network-unauth RCE nature nonetheless justify treating this as high urgency rather than a high-CVSS-but-low-real-risk issue.

A remote attacker sends a crafted HTTP POST request to the Control Web Panel protected_directory module using the acc=deletedp action, embedding shell metacharacters in the file parameter. Because this value is passed unescaped into a shell_exec call, the injected commands run on the server, yielding arbitrary OS command execution. A public PoC reference exists (VulnCheck blog); it is not verified as working exploit code.