# CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29) · pwn.watch

> On Nov 3 2026 VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP, formerly CentOS Web Panel) that chain from an unauthenticated request to a root shell. The CWP user panel (port 2083) sends its login redirect without stopping execution (CVE-2026-73696), so an attacker-named module file is included before login (path traversal, CVE-2026-73695); the phpini_editor and protected_directory modules then give file write and command execution as the hosting user (CVE-2026-73697, CVE-2026-77876). From that foothold, the root-owned loopback user API on 127.0.0.1:2302 has ungated routes (CVE-2026-77877), root command injections in /v1/restoredatabase/, /v1/newpass/ and /v1/valid_token/ (CVE-2026-77878, CVE-2026-77880, CVE-2026-104080) and SQL injections in its access_token() gate and dashboard route (CVE-2026-77879, CVE-2026-77881). The only precondition is one valid hosting account name, which the panel confirms (302 vs 404). CWP fixed the bugs in stages without naming CVEs: 1.12 closed the pre-auth entry, 1.16 fixed the user-panel modules, and 1.27/1.29 (Oct 30-31) fixed the user API; all ten are fixed in 1.29. VulnCheck counts tens of thousands of internet-exposed CWP panels. No in-the-wild exploitation reported yet, but the previous CWP user-panel RCE (CVE-2025-48703) was mass-exploited and is in CISA KEV.

Page: https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 · generated 2026-11-08T06:45:48.368Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Control Web Panel (CWP, formerly CentOS Web Panel)
- Started: 2026-11-03
- CVEs: CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080
- Affected: CWP before 1.12: unauthenticated remote root (needs one valid account name); CWP before 1.16: any hosting account can use the user-panel module bugs (CVE-2026-73695, -73697, -77876, -77879, -77880); CWP before 1.29: any hosting account can become root through the user API (CVE-2026-77877, -77878, -77881, -104080)
- Fixed in: CWP 1.29 (Oct 31 2026) fixes all ten; 1.30 is the current release

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026.json
- This file: https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-03: VulnCheck publishes the CWP2Shell write-up: two requests take an unauthenticated attacker with one valid account name to uid 0; it says operators should upgrade to 1.29 or later and keep ports 2083 and 2031/2087 off the internet. (https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce)
- 2026-11-02: The VulnCheck CNA publishes the ten CVE records (CVE-2026-73695 through CVE-2026-104080). (https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php)
- 2026-10-31: CWP 1.29 requires a valid session on the user API routes and validates input, fixing CVE-2026-77877, -77878, -77881 and -104080 (after the 1.27 security review on Oct 30); all ten are now fixed. (https://control-webpanel.com/changelog)
- 2026-09-29: CWP 1.16 build fixes the user-panel module bugs and two user API sinks (CVE-2026-73695, -73697, -77876, -77879, -77880); the root user API stays exploitable from any hosting account. (https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce)
- 2026-09-08: CWP 1.12 adds the missing exit() after the user-panel login redirect and checks the session before including modules, closing the unauthenticated entry (CVE-2026-73696); the other bugs stay reachable from an authenticated account. (https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce)

## Fix brief
# Security brief: CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29)

Source: https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 · status: live · severity: critical · updated Nov 8, 2026, 05:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
On Nov 3 2026 VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP, formerly CentOS Web Panel) that chain from an unauthenticated request to a root shell. The CWP user panel (port 2083) sends its login redirect without stopping execution (CVE-2026-73696), so an attacker-named module file is included before login (path traversal, CVE-2026-73695); the phpini_editor and protected_directory modules then give file write and command execution as the hosting user (CVE-2026-73697, CVE-2026-77876). From that foothold, the root-owned loopback user API on 127.0.0.1:2302 has ungated routes (CVE-2026-77877), root command injections in /v1/restoredatabase/, /v1/newpass/ and /v1/valid_token/ (CVE-2026-77878, CVE-2026-77880, CVE-2026-104080) and SQL injections in its access_token() gate and dashboard route (CVE-2026-77879, CVE-2026-77881). The only precondition is one valid hosting account name, which the panel confirms (302 vs 404). CWP fixed the bugs in stages without naming CVEs: 1.12 closed the pre-auth entry, 1.16 fixed the user-panel modules, and 1.27/1.29 (Oct 30-31) fixed the user API; all ten are fixed in 1.29. VulnCheck counts tens of thousands of internet-exposed CWP panels. No in-the-wild exploitation reported yet, but the previous CWP user-panel RCE (CVE-2025-48703) was mass-exploited and is in CISA KEV.

Severity detail: VulnCheck rates the chained attack 10.0 (unauthenticated to root with only a valid account name) and the pre-auth stage 9.8; GitHub Advisory rates CVE-2026-73695 Critical (9.3). The individual CVE records from the VulnCheck CNA are High (CVSS 4.0 6.8-8.7). No in-the-wild exploitation reported.

- Product: Control Web Panel (CWP, formerly CentOS Web Panel)
- CVE / advisory ids: CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080

## Affected versions
- CWP before 1.12: unauthenticated remote root (needs one valid account name)
- CWP before 1.16: any hosting account can use the user-panel module bugs (CVE-2026-73695, -73697, -77876, -77879, -77880)
- CWP before 1.29: any hosting account can become root through the user API (CVE-2026-77877, -77878, -77881, -104080)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- CWP 1.29 (Oct 31 2026) fixes all ten; 1.30 is the current release

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Upgrade CWP to 1.29 or later (1.30 is current). Builds before 1.12 are reachable to root without authentication given one account name. Even on fixed builds, keep the user panel (2083) and admin panel (2031/2087) off the public internet or behind an allowlist (VulnCheck recommendation).

## Latest updates
- Nov 3, 2026: VulnCheck publishes the CWP2Shell write-up: two requests take an unauthenticated attacker with one valid account name to uid 0; it says operators should upgrade to 1.29 or later and keep ports 2083 and 2031/2087 off the internet.
- Nov 2, 2026: The VulnCheck CNA publishes the ten CVE records (CVE-2026-73695 through CVE-2026-104080).
- Oct 31, 2026: CWP 1.29 requires a valid session on the user API routes and validates input, fixing CVE-2026-77877, -77878, -77881 and -104080 (after the 1.27 security review on Oct 30); all ten are now fixed.
- Sep 29, 2026: CWP 1.16 build fixes the user-panel module bugs and two user API sinks (CVE-2026-73695, -73697, -77876, -77879, -77880); the root user API stays exploitable from any hosting account.
- Sep 8, 2026: CWP 1.12 adds the missing exit() after the user-panel login redirect and checks the session before including modules, closing the unauthenticated entry (CVE-2026-73696); the other bugs stay reachable from an authenticated account.

## Advisories
- [Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php (CVE-2026-73695)](https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php) (VulnCheck)
- [Control Web Panel (CWP) OS Command Injection via valid_token (CVE-2026-104080)](https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-valid-token) (VulnCheck)
- [GHSA-m2m4-55x5-x967 (CVE-2026-73695)](https://github.com/advisories/GHSA-m2m4-55x5-x967) (GitHub Advisory Database)
- [CWP changelog](https://control-webpanel.com/changelog) (CWP)

## Write-ups & news
- [CWP2Shell: The Login Page That Never Says No](https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce)

## Caveats
Related: CWPdoor (trojanized cwpsrv backdoor, initial access unknown) is tracked separately; there is no reported link between CWPdoor and these CVEs.

---
Machine-readable: https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.