PT-2026-42016 · Ctrlpanel · Ctrlpanel

Published 2026-05-19 · Updated 2026-05-21 · CVE-2026-34234

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CtrlPanel versions prior to 1.2.0

Description The web-based installer at the endpoint "public/installer/index.php" allows unauthenticated Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine. The issue occurs because the system executes form handler files before verifying the install.lock file, keeping installer endpoints accessible even after installation. Additionally, these handlers pass unsanitized user input directly into shell commands. This issue is reported to be actively exploited in the wild.

Recommendations Update to version 1.2.0.

Exploit

Fix

RCE

Improper Access Control

OS Command Injection

Weakness Enumeration

CWE-284

CWE-78

Related Identifiers

CVE-2026-34234

Affected Products

Ctrlpanel

References · 7

• 🔥 https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-jmhr-q9q5-fqwh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34234 · Security Note
• https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0 · Note
• https://twitter.com/CVEnew/status/2056870178437083400 · Twitter Post
• https://t.me/cveNotify/164223 · Telegram Post
• https://t.me/CVEtracker/54291 · Telegram Post
• https://twitter.com/TuringCyberObs/status/2057480013214023760 · Twitter Post