CWP Control Web Panel OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 04/11/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| webpanel | < 0.9.8.1205 | 0.9.8.1205 |
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free