CVE-2026-104080
HIGH
NVD
CVSS Score
8.4
Severity
HIGH
Published
Nov 02, 2026
Vendor
unknown
Description
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.