Control Web Panel flaws chain to unauthenticated root access

SecurityOnline[.]info reports that VulnCheck researcher Valentin Lobstein disclosed a chain of ten vulnerabilities in Control Web Panel (CWP) that can provide unauthenticated root access when combined. The flaws span pre-authentication and post-authentication paths, with the entry point described as CVE-2026-73695 (path traversal via the services/users/index.php), followed by subsequent issues including CVE-2026-73696 (execution after redirect) and CVE-2026-73697 (phpini_editor file write and command injection).

The chain then reaches a loopback API on 127.0.0[.]1:2302, where multiple flaws enable root escalation, notably CVE-2026-77877 (unauthenticated loopback API root access), CVE-2026-77878 (os command injection via restoredatabase), CVE-2026-104080 (root command injection via valid_token), and related issues such as CVE-2026-77879, CVE-2026-77880 and CVE-2026-77881. The report emphasises that, taken together, these allow an attacker to move from a hosting user to root on the affected server.

The vendor’s updates address all ten flaws, culminating in version 1.29 (with 1.30 as the current release). A public PoC exploit for CVE-2026-73695 exists in VulnCheck’s repository, though the advisory notes that no confirmed mass exploitation has been observed in the wild to date.

The affected versions are Control Web Panel builds prior to 1.29, with testing cited on CWP7 webpanel build 1.8 on AlmaLinux 9. The advisory states that builds from 1.12 through 1.27 remained open to local root takeover, and that the 1.12 change introduced an exit() after login redirects, while 1.27 and 1.29 left certain internal APIs exposed until remediation. The patch sequence is described as ending in October 2026, with 1.29 fixing the pre-auth entry and subsequent local API protections.

Administrators are urged to update to 1.29 or 1.30 and to limit exposure of the user panel on port 2083, as well as the admin panel on ports 2031 and 2087, preferably behind an IP allow-list or VPN.