Which versions of Control Web Panel are affected by EUVD-2026-41027?

Control Web Panel (CWP) versions before 0.9.8.1225 contain a critical unauthenticated remote code execution vulnerability that any internet-connected attacker can exploit without credentials.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-41027?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41027. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate EUVD-2026-41027?

Within 24 hours: inventory all CWP deployments and document current versions; restrict network access to CWP web interfaces for any instances below 0.9.8.1225. Within 7 days: upgrade all CWP installations to version 0.9.8.1225 or later. Within 30 days: review system logs, file modifications, and webshell artifacts on all upgraded servers to confirm no prior exploitation.

Control Web Panel EUVD-2026-41027

Q: What is the CVSS score of EUVD-2026-41027?

EUVD-2026-41027 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-57517 CRITICAL

SQL Injection (CWE-89)

2026-07-01 VulnCheck

GHSA-pc6r-ch59-5926

PHP RCE SQLi Control Web Panel

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Remote unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N) that pivots out of the database to OS-level RCE as cwpsvc justifies S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:52 vuln.today

CVE Published

Jul 01, 2026 - 15:11 cve.org

CRITICAL 9.3

DescriptionCVE.org

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.

Articles & Coverage 1

News Critical SQL Injection RCE in Control Web Panel (CWP) - CVE-2026-57517 Jul 02, 2026

AnalysisAI

Unauthenticated blind SQL injection in Control Web Panel (CWP) before 0.9.8.1225 lets remote attackers inject arbitrary SQL through the userRes POST parameter of the user endpoint, and because CWP's MySQL connection runs with root privileges the flaw escalates to full remote code execution via INTO DUMPFILE. Attackers write a PHP webshell into the web-accessible roundcube logs directory and execute commands as the cwpsvc account. Publicly available exploit code exists and a vendor patch has been released; this is a network, no-authentication, low-complexity issue (CVSS 4.0 9.3).

Technical ContextAI

Control Web Panel (formerly CentOS Web Panel) is a free server administration/hosting control panel for RHEL-family Linux, commonly deployed on VPS and shared-hosting servers to manage web, mail, and database services. The root cause is CWP's admin bundled MySQL/MariaDB. Because the panel connects to the database as the MySQL root user, an attacker who controls the query can leverage the FILE privilege and INTO DUMPFILE to write attacker-controlled bytes to arbitrary filesystem paths - here a PHP webshell placed in the web-accessible roundcube logs directory, which the PHP-serving cwpsvc process then executes, converting a database-layer flaw into OS-level code execution.

RemediationAI

Vendor-released patch: upgrade Control Web Panel to 0.9.8.1225 or later per the vendor changelog (https://control-webpanel.com/changelog#1773753427572-9bf81bf4-f2d2), which is the primary and recommended fix. Until patching is possible, restrict network exposure of the CWP management interface - place the panel behind a VPN or IP allowlist and block untrusted access to the user endpoint, accepting that this limits legitimate remote administration. As a defense-in-depth measure, review whether the panel's MySQL connection must run as root and confirm the roundcube logs directory is not writable-and-web-executable, since removing the FILE-privilege-to-webshell path breaks the RCE portion of the chain even if injection remains; note these hardening steps may affect mail/webmail functionality and are no substitute for the patch. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/control-web-panel-blind-sql-injection-via-userres-parameter) for detection guidance.