Ctrlpanel-gg panel up to 1.1.x Admin Settings Update Endpoint update settings_class externally-controlled input to select classes or code

Summaryinfo

A vulnerability categorized as problematic has been discovered in Ctrlpanel-gg panel up to 1.1.x. This impacts the function update of the component Admin Settings Update Endpoint. Such manipulation of the argument settings_class leads to use of externally-controlled input to select classes or code. This vulnerability is documented as CVE-2026-34216. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Ctrlpanel-gg panel up to 1.1.x. Affected by this issue is the function update of the component Admin Settings Update Endpoint. The manipulation of the argument settings_class with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. Using CWE to declare the problem leads to CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update endpoint accepted a fully qualified class name directly from user-supplied request input and used it for dynamic static method calls and object instantiation without any allowlist validation, allowing for authenticated Remote Code Execution. An authenticated admin-level user could supply an arbitrary class name available in the Composer autoloader, potentially triggering unintended constructor or magic method execution. The update() method reads settings_class directly from the HTTP request and passed it to new $settings_class() and $settings_class::getValidations() without verifying that the provided value corresponds to a legitimate settings class: Because PHP resolves class names against the Composer autoloader at runtime, any autoloadable class in the application or its dependencies could be instantiated. Depending on the classes available in the dependency tree, this can trigger unintended side effects through constructors or magic methods (__construct, __toString, __wakeup), following a PHP object injection / gadget chain pattern. This issue has been fixed in version 1.2.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-34216 since 03/26/2026. The exploitation is known to be difficult. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30983). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Ctrlpanel-gg

Name

• panel

Version

• 1.0
• 1.1

Website

• Product: https://github.com/Ctrlpanel-gg/panel/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion