Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29)

Control Web Panel (CWP, formerly CentOS Web Panel)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

On Nov 3 2026 VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP, formerly CentOS Web Panel) that chain from an unauthenticated request to a root shell. The CWP user panel (port 2083) sends its login redirect without stopping execution (CVE-2026-73696), so an attacker-named module file is included before login (path traversal, CVE-2026-73695); the phpini_editor and protected_directory modules then give file write and command execution as the hosting user (CVE-2026-73697, CVE-2026-77876). From that foothold, the root-owned loopback user API on 127.0.0.1:2302 has ungated routes (CVE-2026-77877), root command injections in /v1/restoredatabase/, /v1/newpass/ and /v1/valid_token/ (CVE-2026-77878, CVE-2026-77880, CVE-2026-104080) and SQL injections in its access_token() gate and dashboard route (CVE-2026-77879, CVE-2026-77881). The only precondition is one valid hosting account name, which the panel confirms (302 vs 404). CWP fixed the bugs in stages without naming CVEs: 1.12 closed the pre-auth entry, 1.16 fixed the user-panel modules, and 1.27/1.29 (Oct 30-31) fixed the user API; all ten are fixed in 1.29. VulnCheck counts tens of thousands of internet-exposed CWP panels. No in-the-wild exploitation reported yet, but the previous CWP user-panel RCE (CVE-2025-48703) was mass-exploited and is in CISA KEV.

Why this severity: VulnCheck rates the chained attack 10.0 (unauthenticated to root with only a valid account name) and the pre-auth stage 9.8; GitHub Advisory rates CVE-2026-73695 Critical (9.3). The individual CVE records from the VulnCheck CNA are High (CVSS 4.0 6.8-8.7). No in-the-wild exploitation reported.

Started
Nov 3, 2026
CVEs
CVE-2026-73695CVE-2026-73696CVE-2026-73697CVE-2026-77876CVE-2026-77877CVE-2026-77878CVE-2026-77879CVE-2026-77880CVE-2026-77881CVE-2026-104080

Follow this incident

Discuss on X ↗

Affected

  • CWP before 1.12: unauthenticated remote root (needs one valid account name)
  • CWP before 1.16: any hosting account can use the user-panel module bugs (CVE-2026-73695, -73697, -77876, -77879, -77880)
  • CWP before 1.29: any hosting account can become root through the user API (CVE-2026-77877, -77878, -77881, -104080)

Fixed in

  • CWP 1.29 (Oct 31 2026) fixes all ten; 1.30 is the current release

Timeline5

  1. VulnCheck publishes the CWP2Shell write-up: two requests take an unauthenticated attacker with one valid account name to uid 0; it says operators should upgrade to 1.29 or later and keep ports 2083 and 2031/2087 off the internet.

  2. The VulnCheck CNA publishes the ten CVE records (CVE-2026-73695 through CVE-2026-104080).

  3. CWP 1.29 requires a valid session on the user API routes and validates input, fixing CVE-2026-77877, -77878, -77881 and -104080 (after the 1.27 security review on Oct 30); all ten are now fixed.

  4. CWP 1.16 build fixes the user-panel module bugs and two user API sinks (CVE-2026-73695, -73697, -77876, -77879, -77880); the root user API stays exploitable from any hosting account.

  5. CWP 1.12 adds the missing exit() after the user-panel login redirect and checks the session before including modules, closing the unauthenticated entry (CVE-2026-73696); the other bugs stay reachable from an authenticated account.

Advisories4

News & write-ups1
Posts1
ʞʞıdɐɔoɥƆ
@Chocapikk_

Today, @VulnCheckAI disclosed an unauthenticated remote root RCE chain in Control Web Panel. CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080. t.co/GIct4zBfjM t.co/7aeCpjl5nX

Notes & caveats

Related: CWPdoor (trojanized cwpsrv backdoor, initial access unknown) is tracked separately; there is no reported link between CWPdoor and these CVEs.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo