An OS command injection flaw in Control Web Panel (CWP) versions before 1.16 lets attackers run arbitrary commands through the user panel's protected_directory module.
What Is It
CVE-2026-77876 is an OS command injection vulnerability (CWE-78) in the protected_directory module of the Control Web Panel user panel. The flaw is in the acc=deletedp action. Input sent in the file POST parameter is not escaped and goes straight into a shell_exec call. An attacker can put arbitrary commands in that parameter and get code execution in the user panel context.
VulnCheck disclosed the issue, and NVD published it on November 2, 2026. NVD lists the record's status as "Deferred."
Why It Matters
VulnCheck scores the issue 9.8 (CRITICAL) under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 (CRITICAL) under CVSS 4.0. Both vectors describe a flaw with these properties:
- Reachable over the network
- Low attack complexity
- No privileges required
- No user interaction required
- High impact to confidentiality, integrity, and availability
CWP is a web hosting control panel, so it is often exposed to the internet. The vulnerable module is part of the CWP user panel, which normally requires a logged-in account. The CVSS vectors say no privileges are needed, but the available advisory data does not show whether an unauthenticated attacker can actually reach the acc=deletedp action, or whether any valid user panel account is enough. In either case, this is command injection on an internet-facing hosting panel. It should be a high priority, especially on servers that host many user accounts or allow open sign-ups.
Exploitation status: No CISA KEV entry was supplied for this CVE, so CISA has not confirmed active exploitation. The CVSS 4.0 Exploit Maturity metric is also "Not Defined."
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| Control Web Panel | Control Web Panel (CWP) | All versions before webpanel_version 1.16 |
- Vulnerable component: the
protected_directoryuser panel module,acc=deletedpaction,filePOST parameter - CPE data: NVD has not listed any affected CPEs yet.
Patch Status
The advisory says only versions before webpanel_version 1.16 are affected, which indicates version 1.16 likely contains the fix. Administrators should take these steps:
- Confirm which CWP version they are running.
- Upgrade to webpanel_version 1.16 or later.
- Read the vendor changelog for release details.
CISA has not issued a required action or remediation deadline, because no KEV entry exists for this CVE.