{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29) · updates",
  "home_page_url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026",
  "feed_url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026/feed.json",
  "description": "On Nov 3 2026 VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP, formerly CentOS Web Panel) that chain from an unauthenticated request to a root shell. The CWP user panel (port 2083) sends its login redirect without stopping execution (CVE-2026-73696), so an attacker-named module file is included before login (path traversal, CVE-2026-73695); the phpini_editor and protected_directory modules then give file write and command execution as the hosting user (CVE-2026-73697, CVE-2026-77876). From that foothold, the root-owned loopback user API on 127.0.0.1:2302 has ungated routes (CVE-2026-77877), root command injections in /v1/restoredatabase/, /v1/newpass/ and /v1/valid_token/ (CVE-2026-77878, CVE-2026-77880, CVE-2026-104080) and SQL injections in its access_token() gate and dashboard route (CVE-2026-77879, CVE-2026-77881). The only precondition is one valid hosting account name, which the panel confirms (302 vs 404). CWP fixed the bugs in stages without naming CVEs: 1.12 closed the pre-auth entry, 1.16 fixed the user-panel modules, and 1.27/1.29 (Oct 30-31) fixed the user API; all ten are fixed in 1.29. VulnCheck counts tens of thousands of internet-exposed CWP panels. No in-the-wild exploitation reported yet, but the previous CWP user-panel RCE (CVE-2025-48703) was mass-exploited and is in CISA KEV.",
  "language": "en",
  "_pwn": {
    "slug": "cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-11-03-13dbde2b",
      "url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-11-03-13dbde2b",
      "title": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): VulnCheck publishes the CWP2Shell write-up: two requests take an unauthenticated attacker with one valid account name to uid 0; it says operators should upgrade to 1.29 or later and keep ports 2083 and 2031/2087 off the internet.",
      "content_text": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): VulnCheck publishes the CWP2Shell write-up: two requests take an unauthenticated attacker with one valid account name to uid 0; it says operators should upgrade to 1.29 or later and keep ports 2083 and 2031/2087 off the internet.\n\nSource: https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-11-02-bfd660bd",
      "url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-11-02-bfd660bd",
      "title": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): The VulnCheck CNA publishes the ten CVE records (CVE-2026-73695 through CVE-2026-104080).",
      "content_text": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): The VulnCheck CNA publishes the ten CVE records (CVE-2026-73695 through CVE-2026-104080).\n\nSource: https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php",
      "date_published": "2026-11-02T00:00:00.000Z",
      "external_url": "https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-10-31-32e421c7",
      "url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-10-31-32e421c7",
      "title": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.29 requires a valid session on the user API routes and validates input, fixing CVE-2026-77877, -77878, -77881 and -104080 (after the 1.27 security review on Oct 30); all ten are now fixed.",
      "content_text": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.29 requires a valid session on the user API routes and validates input, fixing CVE-2026-77877, -77878, -77881 and -104080 (after the 1.27 security review on Oct 30); all ten are now fixed.\n\nSource: https://control-webpanel.com/changelog",
      "date_published": "2026-10-31T00:00:00.000Z",
      "external_url": "https://control-webpanel.com/changelog",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-09-29-67f5b7cf",
      "url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-09-29-67f5b7cf",
      "title": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.16 build fixes the user-panel module bugs and two user API sinks (CVE-2026-73695, -73697, -77876, -77879, -77880); the root user API stays exploitable from any hosting account.",
      "content_text": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.16 build fixes the user-panel module bugs and two user API sinks (CVE-2026-73695, -73697, -77876, -77879, -77880); the root user API stays exploitable from any hosting account.\n\nSource: https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce",
      "date_published": "2026-09-29T00:00:00.000Z",
      "external_url": "https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-09-08-c9525ff0",
      "url": "https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-09-08-c9525ff0",
      "title": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.12 adds the missing exit() after the user-panel login redirect and checks the session before including modules, closing the unauthenticated entry (CVE-2026-73696); the other bugs stay reachable from an authenticated account.",
      "content_text": "CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.12 adds the missing exit() after the user-panel login redirect and checks the session before including modules, closing the unauthenticated entry (CVE-2026-73696); the other bugs stay reachable from an authenticated account.\n\nSource: https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce",
      "date_published": "2026-09-08T00:00:00.000Z",
      "external_url": "https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce",
      "tags": [
        "critical"
      ]
    }
  ]
}