CVE-2026-77876: OS Command Injection in Control Web Panel

CVE-2026-77876 is an OS command injection vulnerability in the protected_directory module of Control Web Panel (CWP) versions before 1.16. Unvalidated input from the file POST parameter in acc=deletedp requests is passed directly to a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.

The CVSS score is 9.8, classified as critical severity. The vulnerability was disclosed on November 2, 2026. Current signals show low social media activity (3 posts on X in the last 24 hours), and public exploit availability is not confirmed. However, the official NVD description does not mention signs of active attacks or confirmed exploitation in the wild. Reports on X indicate discrepancies regarding affected versions (1.16 vs 1.27 vs 1.30 in patch recommendations), which should be clarified directly with CWP maintainers.

If you manage a Control Web Panel instance, immediately identify your version and, if it is before 1.16, proceed to update to the latest patches (community suggestions indicate version 1.30 as the target). Review access logs of the protected_directory module for suspicious activity. Until patching is complete, consider restricting user panel access to trusted IP addresses. Remember to validate this information through official CWP communications to resolve the version conflict observed in community reports.