CVE-2026-77876: modules/protected_directory.php acc=deletedp sed shell_exec
Unquoted sed shell-out in protected_directory acc=deletedp. Same class of ungated module sink as phpini_editor; separate fix location, separate CVE.
Executive Summary & Technical Impact
Unquoted sed shell-out in protected_directory acc=deletedp. Same class of ungated module sink as phpini_editor; separate fix location, separate CVE.
Tracked under CVE-2026-77876 (CWE-78 (OS Command Injection)), this vulnerability affects CWP before 1.16 and carries a severity score of 9.8 (CRITICAL). Engineering and security operations teams running Control Web Panel (CWP) protected_directory module should prioritize upgrading to CWP 1.16+ (escapeshellarg; deletedp sed sink removed).
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
Frequently Asked Questions (CVE-2026-77876)
What versions are affected by CVE-2026-77876?
CVE-2026-77876 affects CWP before 1.16 in Control Web Panel (CWP) protected_directory module (modules/protected_directory.php acc=deletedp sed shell_exec).
How do I patch or remediate CVE-2026-77876?
Upgrade affected deployments to CWP 1.16+ (escapeshellarg; deletedp sed sink removed) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-77876?
CVE-2026-77876 is rated CRITICAL with a CVSS score of 9.8 (vector: Network; pre-auth when chained with dispatcher EAR/LFI; runs as hosting user).
