{"basis":"claimed","id":"CVE-2026-77876","name":"Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory","vendorProject":"Control Web Panel","product":"Control Web Panel","publishedAt":"2026-11-02","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"exploited":null,"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.","cwes":["CWE-78"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:25:30.509Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":null,"measured":[],"social":{"total":3,"first_seen":"2026-11-02T21:22:39.000Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":3}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/TheHackerWire/status/2117380111850950919","author":"TheHackerWire","author_name":"The Hacker Wire","avatar_url":"https://pbs.twimg.com/profile_images/1749149482153902080/5bIzmpsm_bigger.jpg","text":"🚨 CVE-2026-77876 & 73696 (CVSS 9.8 Critical) - PoC Active\n\nExecution After Redirect auth bypass in Control Web Panel (CWP < 1.16) chains with command injection in protected_directory for root RCE.\n\n⚡ Action: Upgrade CWP to v1.16 immediately.\n\n🔗 https://t.co/ZSp7kEUVAY https://…","engagement":0,"posted_at":"2026-11-02T22:15:32.000Z"},{"source":"x","kind":"post","url":"https://x.com/nurhayatdev/status/2117368963055206907","author":"nurhayatdev","author_name":"Nurhayat Yurtaslan","avatar_url":"https://pbs.twimg.com/profile_images/2110209875598786560/5S-73kR3_bigger.jpg","text":"🚨 CWP CVE-2026-77876: unauthenticated command injection in protected_directory (CVSS 3.1:9.8). Exploitation unconfirmed.\n\nVersion conflict: CNA says <1.16; CWP lists user-panel hardening in 1.27. Update to 1.30; verify.\n\nhttps://t.co/Wu8rQZWckD\nhttps://t.co/E421vKiHPg https://t…","engagement":0,"posted_at":"2026-11-02T21:31:14.000Z"},{"source":"x","kind":"post","url":"https://x.com/cvedotnow/status/2117366805639417935","author":"cvedotnow","author_name":"cve.now","avatar_url":"https://pbs.twimg.com/profile_images/2114469817906577408/drWsbSgs_bigger.jpg","text":"🆕 New CVE\nControl Web Panel: os command injection in protected directory feature (CVE-2026-77876)\nAn attacker who can reach the feature could run arbitrary OS commands and gain code execution in the user panel.\nPatch → 1.16\nhttps://t.co/5mDfyyCozX","engagement":0,"posted_at":"2026-11-02T21:22:39.000Z"}],"exploit_repositories":[]}}