What is CVE-2026-104080 and how does it work?

CVE-2026-104080 is a severe security flaw discovered in Control Web Panel (CWP) affecting versions prior to webpanel_version 1.30 CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4. The vulnerability arises from an OS command injection flaw located in the loopback API /valid_token/ route.

Unauthenticated attackers can exploit this flaw by sending a crafted request that injects shell metacharacters into the unvalidated user parameter. This parameter is then passed unescaped directly into a shell_exec() call, granting root privileges to the attacker.

Who is affected by this Control Web Panel vulnerability?

Any server running Control Web Panel (CWP) prior to version 1.30 is vulnerable to this security issue CVE-2026-58957: Vulnerabilidad Crítica CVSS 8.4. Because the flaw requires no prior authentication, external malicious actors can target exposed administrative interfaces directly.

The combination of unauthenticated access and root-level command execution makes this an urgent priority for system administrators managing legacy environments.

How do I protect my server against this vulnerability?

Mitigating CVE-2026-104080 requires immediate administrative action to patch the underlying API route and ensure system integrity. Similar to when handling Vulnerabilidad crítica CVE-2026-115905 con CVSS 10.0, timely updates are crucial for maintaining secure infrastructure.

You should review the official advisories and apply the latest software updates provided by the vendor.

  1. Verify your current Control Web Panel installation version to check if it is below 1.30.
  2. Consult the official control-webpanel.com changelog for direct patching instructions.
  3. Update Control Web Panel to version 1.30 or higher to eliminate the unescaped shell_exec vulnerability.
  4. Monitor system logs for unexpected unauthenticated requests targeting the /valid_token/ API route.