Multiple security vulnerabilities have been identified in Control Web Panel, affecting builds before 1.29. The flaws span the user panel, internal modules, and a local root-level API, allowing unauthenticated attackers to gain code execution as a hosting user and then escalate to full root control. No active exploitation has been confirmed, but the combination of pre-authentication entry and local privilege escalation creates a severe risk for exposed hosting servers.
CVE-2026-73695 (CVSS 8.8 — High): A path traversal flaw in the user panel lets an unauthenticated attacker include or access internal files after a redirect, enabling initial code execution as a hosting user.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Control Web Panel, affecting builds before 1.29. The flaws span the user panel, internal modules, and a local root-level API, allowing unauthenticated attackers to gain code execution as a hosting user and then escalate to full root control. No active exploitation has been confirmed, but the combination of pre-authentication entry and local privilege escalation creates a severe risk for exposed hosting servers.
CVE-2026-73695 (CVSS 8.8 — High): A path traversal flaw in the user panel lets an unauthenticated attacker include or access internal files after a redirect, enabling initial code execution as a hosting user.[emaillocker id="1283"]
CVE-2026-104080 (CVSS 7.8 — High): A local attacker with hosting-user access can inject operating-system commands into a token validation API endpoint, allowing root-level command execution on the server.
CVE-2026-73697 (CVSS 8.8 — High): A file-write and command-injection flaw in a configuration editor module lets an unauthenticated attacker write a web shell and run shell commands as the target hosting user.
CVE-2026-77876 (CVSS 8.8 — High): An operating-system command injection flaw in a protected-directory management module allows an unauthenticated attacker to execute shell commands as the target hosting user.
CVE-2026-73696 (CVSS 8.1 — High): An execution-after-redirect flaw in the user panel allows an unauthenticated request to continue processing after a login redirect, enabling access to internal modules without authentication.
CVE-2026-77877 (CVSS 7.8 — High): A missing token-check flaw in the local root-level API allows a local attacker to access privileged API routes without authentication, enabling further escalation to root.
CVE-2026-77878 (CVSS 7.8 — High): An operating-system command injection flaw in a database restoration API route allows a local attacker to pass input into a root shell, enabling root command execution.
CVE-2026-77880 (CVSS 7.8 — High): An operating-system command injection flaw in a password-change API route allows a local attacker to execute root-level commands on the server.
CVE-2026-77879: A SQL injection flaw in an access-token validation gate allows a local attacker to bypass login checks by injecting a SQL union string, enabling unauthorized access to privileged functionality.
CVE-2026-77881: A blind database-read flaw in the local root-level API allows an attacker to read database contents as the database root user, exposing sensitive data.
These vulnerabilities collectively present a severe risk to hosting servers with exposed user panels, especially those running older builds. Administrators of internet-facing Control Web Panel instances are most at risk and should treat the issue as urgent.
The following reports contain further technical details:
[/emaillocker]