Control Web Panel: Ten Chained Flaws Enable Unauthenticated Pre-Auth to Root RCE
VulnCheck researcher Valentin Lobstein disclosed ten vulnerabilities in Control Web Panel (CWP), formerly CentOS Web Panel, that chain together to grant an unauthenticated attacker full root access on affected servers. Tracked from CVE-2026-73695 through CVE-2026-104080, the flaws combine a pre-auth redirect bypass and file inclusion bug with unauthenticated module command injection and a loopback root API lacking token checks. VulnCheck estimates roughly 118,151 exposed CWP service records globally, including nearly 20,000 panels reachable on port 2083. No active exploitation has been confirmed, but a public proof-of-concept (go-exploit) exists for the entry-point flaw, and the panel's history shows past bugs were mass-exploited quickly after disclosure.
Entenda a falha
A vulnerabilidade
Ten chained flaws in Control Web Panel (CWP, formerly CentOS Web Panel) give an unauthenticated remote attacker root on the server. The entry point is CVE-2026-73696 (execution after redirect) plus CVE-2026-73695 (file inclusion/path traversal) in the user panel on port 2083. The attacker needs network reach and one valid hosting account name. That gives code execution as the hosting user through CVE-2026-73697 (phpini_editor) and CVE-2026-77876 (protected_directory). Root then comes from a loopback API on 127.0.0.1:2302 with missing token checks (CVE-2026-77877) and CVE-2026-77878, CVE-2026-104080, CVE-2026-77879, CVE-2026-77880 and CVE-2026-77881. Builds before 1.12 are exposed to the full pre-auth chain, builds 1.12 to 1.27 to local root escalation. The fix is in 1.29 (current 1.30).
Como funciona
A request for a dashboard page reaches the user panel without a session. The login code sends a 302 redirect to the login screen but does not stop, so the script keeps running and loads the requested PHP module. Those internal modules have no session checks of their own. Some of them pass user-controlled input, such as POST data or a module name, into shell calls like rm and sed that are not quoted, so the commands run as the hosting user. From there the attacker can reach the root-privileged API on loopback port 2302. Several of its routes skip token validation and pass input to root shell commands or to SQL queries.
Por que é vulnerável
The core cause is a missing exit() after the login redirect, so authorization is effectively skipped (CWE-698). The article notes the admin panel in the same codebase calls exit() after every redirect, so the user panel was inconsistent. On top of that come unquoted shell arguments and unsanitized input (command injection), SQL injection in the access_token() gate, and missing authentication on the loopback root API (CWE-306). The vendor's fixes were staged: 1.12 added exit() after redirects, 1.16 cleaned module names and removed raw shell calls, and 1.27 and 1.29 added session checks, input allow-lists and runuser limits on the port 2302 API.
Onde está
The articles name the user panel login redirect, the phpini_editor and protected_directory modules, and the loopback API on port 2302 (routes /v1/restoredatabase/, /v1/valid_token/, /v1/newpass/ and the access_token() gate); no public code or commit is cited.
Como foi descoberta
VulnCheck researcher Valentin Lobstein found and disclosed the ten flaws in a VulnCheck technical advisory. He unpacked the ionCube-encoded PHP files to read the source and tested the full chain on CWP7 webpanel build 1.8 on AlmaLinux 9. The vendor fixed them in staged releases ending with 1.29 on October 31, 2026. The articles do not describe when the report was made. No exploitation in the wild has been confirmed.
PoC pública
VulnCheck published a working go-exploit module for CVE-2026-73695 in its public repository. It targets the pre-auth entry point of the chain. Nothing in the articles says it has been seen in attacks yet, but past CWP bugs were mass-exploited soon after disclosure, so patching is urgent, especially for internet-exposed panels on port 2083.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 23:15.
Detalhes técnicos
The chain starts with CVE-2026-73696 (execution-after-redirect, CWE-698), where the login page sends a 302 redirect but fails to call exit(), letting code execution continue. This is combined with CVE-2026-73695 (path traversal/file inclusion, CWE-98, CVSS 9.8/10.0 chained) to reach internal unauthenticated modules. CVE-2026-73697 in the phpini_editor module allows webshell writes and command injection via an unquoted rm call; CVE-2026-77876 enables command injection in the protected_directory module via an unquoted sed call. From a hosting-user foothold, CVE-2026-77877 (CWE-306, missing authorization) exposes a root-privileged loopback API on 127.0.0.1:2302, enabling CVE-2026-77878 (root command injection via restoredatabase), CVE-2026-104080 (root command injection via unquoted grep on valid_token), CVE-2026-77879 (SQL injection auth bypass), CVE-2026-77880 (root command execution via newpass/passwd route), and CVE-2026-77881 (blind SQL reads as MySQL root). Builds before 1.12 are exposed to the full pre-auth root chain; builds 1.12–1.27 remain vulnerable to local root escalation.
Remediação
Administrators should update Control Web Panel to version 1.29 or the current 1.30 release immediately. Public internet access to the user panel on port 2083 should be blocked, and admin panel ports 2031 and 2087 restricted behind an IP allow-list or VPN.
Linha do tempo
-
Control Web Panel: Ten Chained Flaws Enable Unauthenticated Pre-Auth to Root RCE
ler a análise desta fonte ocultar
VulnCheck researcher Valentin Lobstein disclosed ten vulnerabilities in Control Web Panel (CWP), formerly CentOS Web Panel, that chain together to grant an unauthenticated attacker full root access on affected servers. Tracked from CVE-2026-73695 through CVE-2026-104080, the flaws combine a pre-auth redirect bypass and file inclusion bug with unauthenticated module command injection and a loopback root API lacking token checks. VulnCheck estimates roughly 118,151 exposed CWP service records globally, including nearly 20,000 panels reachable on port 2083. No active exploitation has been confirmed, but a public proof-of-concept (go-exploit) exists for the entry-point flaw, and the panel's history shows past bugs were mass-exploited quickly after disclosure.
Technical Details
The chain starts with CVE-2026-73696 (execution-after-redirect, CWE-698), where the login page sends a 302 redirect but fails to call exit(), letting code execution continue. This is combined with CVE-2026-73695 (path traversal/file inclusion, CWE-98, CVSS 9.8/10.0 chained) to reach internal unauthenticated modules. CVE-2026-73697 in the phpini_editor module allows webshell writes and command injection via an unquoted rm call; CVE-2026-77876 enables command injection in the protected_directory module via an unquoted sed call. From a hosting-user foothold, CVE-2026-77877 (CWE-306, missing authorization) exposes a root-privileged loopback API on 127.0.0.1:2302, enabling CVE-2026-77878 (root command injection via restoredatabase), CVE-2026-104080 (root command injection via unquoted grep on valid_token), CVE-2026-77879 (SQL injection auth bypass), CVE-2026-77880 (root command execution via newpass/passwd route), and CVE-2026-77881 (blind SQL reads as MySQL root). Builds before 1.12 are exposed to the full pre-auth root chain; builds 1.12–1.27 remain vulnerable to local root escalation.
Remediation
Administrators should update Control Web Panel to version 1.29 or the current 1.30 release immediately. Public internet access to the user panel on port 2083 should be blocked, and admin panel ports 2031 and 2087 restricted behind an IP allow-list or VPN.