PT-2026-38670 · Unknown+1 · Control Web Panel+2

Published 2026-05-08 · Updated 2026-05-26 · CVE-2025-67888

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Control Web Panel (CWP) versions prior to 0.9.8.1209

Description Unauthenticated attackers can inject and execute arbitrary OS commands with root privileges on the web server. This occurs because user input provided through the key GET parameter in the '/admin/index.php' endpoint is not properly sanitized when the api parameter is set. This issue requires the presence of Softaculous or SitePad.

Recommendations Update to version 0.9.8.1209 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-67888

Affected Products

Control Web Panel

Sitepad

Softaculous

References · 8

• 🔥 https://karmainsecurity.com/KIS-2025-09 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67888 · Security Note
• https://t.me/cveNotify/162683 · Telegram Post
• https://twitter.com/CVEnew/status/2053559171316842726 · Twitter Post
• https://wiki.centos-webpanel.com/cwp-security-instructions · Note
• http://seclists.org/fulldisclosure/2025/Dec/25 · Note
• https://twitter.com/DFIR_Lab/status/2059063302597013992 · Twitter Post
• https://t.me/CVEtracker/53094 · Telegram Post