CRITICAL

CVE-2025-48703

Control-webpanel Webpanel 2025-09-19 CVSS v3.1

CVSS

KEV

Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Summary dbcve.org

CWP (Control Web Panel) before version 0.9.8.1205 contains an unauthenticated remote code execution vulnerability in the filemanager component. The t_total parameter in the changePerm request fails to sanitize shell metacharacters, allowing command injection. The attack requires a valid non-root username but needs no authentication beyond that.

Mitigation

Upgrade CWP to version 0.9.8.1205 or later. If immediate patching is not feasible, disable or restrict access to the filemanager module pending the upgrade.

Proof of Concept

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

99.66%

Probability of exploitation in next 30 days

100th percentile

References

https://fenrisk.com/rce-centos-webpanel Exploit, Third Party Advisory https://control-webpanel.com/changelog Release Notes https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE