Control Web Panel CVE-2026-77878

Exploitation requires reaching the loopback-bound database-restore API route /v1/restoredatabase/ - consistent with AV:L, this implies local access to the CWP host (a local account, a process on the box, or a chained path such as SSRF to 127.0.0.1), not direct internet access. Once the route is reachable, no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) are needed: the attacker simply supplies a file path in the POST body containing shell metacharacters, which restoreDBBackup() passes unescaped to a shell running as root. Affected: CWP before webpanel_version 1.30; upgrading to 1.30 is the fix. The primary limiting factor is the local attack vector - the loopback binding prevents straightforward remote, perimeter-based exploitation.

This is a genuinely serious flaw tempered by one important access constraint. The impact ceiling is maximal - OS command injection (CWE-78) executing as root, reflected in the vendor CVSS 4.0 vector's VC:H/VI:H/VA:H. Critically, the vector specifies AV:L (local), not network, which aligns with the 'loopback API' wording in the description: the /v1/restoredatabase/ route is bound to the loopback interface, so an attacker must already have a local foothold on the host (or a means such as SSRF/a chained local service) to reach it - it is not directly internet-exploitable despite the description's phrasing 'an attacker able to reach the route.' That is the key signal to reconcile: raw impact is critical, but reachability is gated by local access. PR:N/UI:N/AC:L mean that once the route is reachable, exploitation is trivial and unauthenticated. No EPSS score and no CISA KEV listing are provided, and there is no confirmed public exploit, so there is no evidence of active or widespread exploitation yet. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a high-impact but local-vector issue where a patch already exists. Net: a real priority for CWP operators to patch promptly, but the local attack vector makes it a privilege-escalation/post-foothold risk rather than a mass-exploitable perimeter bug.

An attacker who has already gained a low-privileged local presence on a CWP server (e.g. a compromised hosting account or a chained local/SSRF path to the loopback interface) sends a crafted POST request to the /v1/restoredatabase/ API with a malicious file path containing shell metacharacters. Because restoreDBBackup() passes this path into a shell command without escaping, the injected commands run as root, yielding full host compromise. No public exploit code is identified at time of analysis, though a VulnCheck advisory documents the flaw.