CVE-2026-104080: /v1/valid_token/ grep shell_exec as root
Separate root command injection on the tokenless /valid_token/ route, identified after the original nine CVEs and allocated as the tenth ID in the CWP2Shell set.
Executive Summary & Technical Impact
Separate root command injection on the tokenless /valid_token/ route, identified after the original nine CVEs and allocated as the tenth ID in the CWP2Shell set.
Tracked under CVE-2026-104080 (CWE-78 (OS Command Injection)), this vulnerability affects CWP 1.16 through 1.23 (live); closed in 1.29 and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Control Web Panel (CWP) user API should prioritize upgrading to CWP 1.29 (cwp_clean_username prevents metacharacters).
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
Frequently Asked Questions (CVE-2026-104080)
What versions are affected by CVE-2026-104080?
CVE-2026-104080 affects CWP 1.16 through 1.23 (live); closed in 1.29 in Control Web Panel (CWP) user API (/v1/valid_token/ grep shell_exec as root).
How do I patch or remediate CVE-2026-104080?
Upgrade affected deployments to CWP 1.29 (cwp_clean_username prevents metacharacters) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-104080?
CVE-2026-104080 is rated HIGH with a CVSS score of 8.8 (vector: Local loopback; raw user value into root grep shell command).
