CISA Alerts of Control Web Panel Command Injection Flaw Actively Exploited

CISA has issued an urgent alert about a critical command-injection flaw in Control Web Panel that is currently being actively exploited in the wild. Tracked as CVE-2025-48703, the vulnerability allows unauthenticated attackers to execute arbitrary operating system commands remotely, potentially leading to complete server compromise and access to sensitive data.

The flaw exists in the file manager module and specifically concerns how the t_total parameter in changePerm requests is handled, enabling attackers to inject shell metacharacters and run commands with the web panel process’s privileges, CWE-78. According to CISA’s advisory, attackers need a valid non-root username to exploit this vulnerability, and the agency has set a mandatory response deadline of 25 November 2025, underscoring the urgency for patching and mitigations.

Control Web Panel—formerly known as CentOS Web Panel—is widely deployed for managing Linux-based web servers, and the guidance recommends applying vendor patches or, where that is not possible, implementing network restrictions and other mitigations across affected systems.