Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-77878

Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API

CVSS 4.0 8.5 HIGHCVSS 3.1 7.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-77878

Published

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-77878

Published

Control Web Panel

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "Control Web Panel",
                    "product": "Control Web Panel",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom",
                            "lessThan": "1.29"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON