CVE-2026-104080 Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...