CVE-2026-77880 HIGH · CVSS 8.8 · Control Web Panel — Control Web Panel (CWP) user API · 2026-11-03

CVE-2026-77880: /v1/newpass/ passwd shell_exec as root

Q: What versions are affected by CVE-2026-77880?

CVE-2026-77880 affects CWP before 1.16 in Control Web Panel (CWP) user API (/v1/newpass/ passwd shell_exec as root).

Q: How do I patch or remediate CVE-2026-77880?

To remediate CVE-2026-77880, upgrade to the patched release: CWP 1.16 (username allow-list + escapeshellarg). Upgrade to CWP 1.29 or later.

Q: What is the CVSS score and severity of CVE-2026-77880?

CVE-2026-77880 is rated HIGH with a CVSS score of 8.8 (Local loopback; raw user field into root passwd after forged token) and is classified under CWE-78 (OS Command Injection).

Root command injection in /v1/newpass/. Reached after forging the access_token gate (CVE-2026-77879) or when other auth controls fail.

Identifier

CVE-2026-77880

Vendor / Product

Control Web Panel · Control Web Panel (CWP) user API

Severity / CVSS

HIGH · CVSS 8.8

Vector / CWE

CWE-78 (OS Command Injection)

Local loopback; raw user field into root passwd after forged token

Affected

CWP before 1.16

Patched Version

CWP 1.16 (username allow-list + escapeshellarg)

Priority

P0 — Root Sink Behind CVE-2026-77879

Executive Summary & Technical Impact

Root command injection in /v1/newpass/. Reached after forging the access_token gate (CVE-2026-77879) or when other auth controls fail.

Tracked under CVE-2026-77880 (CWE-78 (OS Command Injection)), this vulnerability affects CWP before 1.16 and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Control Web Panel (CWP) user API should prioritize upgrading to CWP 1.16 (username allow-list + escapeshellarg).

Remediation & Patch Guidance

Upgrade to CWP 1.29 or later.

Frequently Asked Questions (CVE-2026-77880)

What versions are affected by CVE-2026-77880?

CVE-2026-77880 affects CWP before 1.16 in Control Web Panel (CWP) user API (/v1/newpass/ passwd shell_exec as root).

How do I patch or remediate CVE-2026-77880?

Upgrade affected deployments to CWP 1.16 (username allow-list + escapeshellarg) and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-77880?

CVE-2026-77880 is rated HIGH with a CVSS score of 8.8 (vector: Local loopback; raw user field into root passwd after forged token).

Full TechPulse Investigation

CWP2Shell: Ten New Control Web Panel Bugs Turn a Login Page Into Root

VulnCheck's November 3 disclosure shows how a missing exit() after a 302 in Control Web Panel's user panel opens an unauthenticated path to root. Upgrade to 1.29 or later.

Read full engineering post-mortem (6 min read) →