CVE-2026-77878: /v1/restoredatabase/ mysql shell_exec as root
Root OS command injection in the user API database-restore route. VulnCheck's public exploit relays through this sink after the pre-auth foothold.
Executive Summary & Technical Impact
Root OS command injection in the user API database-restore route. VulnCheck's public exploit relays through this sink after the pre-auth foothold.
Tracked under CVE-2026-77878 (CWE-78 (OS Command Injection)), this vulnerability affects CWP before 1.29 and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Control Web Panel (CWP) user API should prioritize upgrading to CWP 1.29 (token gate + path confinement + escapeshellarg).
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
Frequently Asked Questions (CVE-2026-77878)
What versions are affected by CVE-2026-77878?
CVE-2026-77878 affects CWP before 1.29 in Control Web Panel (CWP) user API (/v1/restoredatabase/ mysql shell_exec as root).
How do I patch or remediate CVE-2026-77878?
Upgrade affected deployments to CWP 1.29 (token gate + path confinement + escapeshellarg) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-77878?
CVE-2026-77878 is rated HIGH with a CVSS score of 8.8 (vector: Local loopback; raw file parameter spliced into root mysql shell command).
