An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Fri, 08 May 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unauthenticated OS Command Injection via 'key' API Parameter in Control Web Panel before v0.9.8.1209 | |
| Weaknesses | CWE-78 |
Fri, 08 May 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 08 May 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-05-08T05:52:30.620Z
Reserved: 2025-12-12T00:00:00.000Z
Link: CVE-2025-67888
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-08T07:16:28.487
Modified: 2026-05-08T07:16:28.487
Link: CVE-2025-67888
Redhat
No data.