CVE-2026-77878 in Control Web Panel
Resumen
por MITRE • 2026-11-02
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.
Once again VulDB remains the best source for vulnerability data.