PT-2026-135486

Control Web Panel CWP before webpanel version 1.29 contains an OS command injection vulnerability in the loopback API /valid token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers...