What is CVE-2026-77878 in Control Web Panel?
Control Web Panel before version 1.30 contains a critical security flaw designated as CVE-2026-77878 with a CVSS score of 8.4. This issue involves an OS command injection vulnerability located within the loopback API database restore route.
The flaw resides specifically in the restoreDBBackup() handler, which fails to properly escape an attacker-controlled file path passed directly from the POST body into an underlying shell command.
Como en otras incidencias graves analizadas previamente, como en el fallo de escalada de privilegios, la validación incorrecta de entradas puede derivar en brechas severas. Es recomendable revisar los avisos en para comprender el vector completo.
Who is affected and what are the risks?
Any malicious actor who manages to reach the vulnerable loopback API route can exploit this vulnerability to execute arbitrary OS commands.
Because these injected commands execute with root privileges, the potential impact on the underlying host system is catastrophic. Similar to vulnerabilities found in other components, such as la librería zip de Rust, unhandled inputs create wide systemic risk.
How do I secure my server against this flaw?
Administrators must apply mitigation strategies immediately to secure their hosting environments against unauthorized exploitation. You should check the official changelog de CWP for direct upgrade paths.
Please follow these essential mitigation steps to protect your server infrastructure:
- Upgrade Control Web Panel immediately to version 1.30 or higher.
- Restrict network access to internal loopback and API endpoints to prevent external reach.
- Monitor server logs regularly for anomalous POST requests directed at /v1/restoredatabase/.