What’s Vulnerable › Vulnerabilities

CVE-2025-48703: CWP Control Web Panel OS Command Injection Vulnerability

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-11-04
• EPSS: 99.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-19 · updated 2026-06-17
• Weakness: CWE-78

Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Affected products

• CentOS Web Panel: before 0.9.8.1205 — fixed in 0.9.8.1205

How to fix

Upgrade to a fixed version: CentOS Web Panel 0.9.8.1205. Check the vendor advisory for mitigations.

References

• https://fenrisk.com/rce-centos-webpanel
• https://control-webpanel.com/changelog
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703

Get alerted when CVE-2025-48703 or the next vulnerability affects your stack