CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
References
| Link | Resource |
|---|---|
| https://fenrisk.com/rce-centos-webpanel | Exploit Third Party Advisory |
| https://control-webpanel.com/changelog | Release Notes |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 | US Government Resource |
Configurations
History
05 Nov 2025, 14:07
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Control-webpanel webpanel
Control-webpanel |
|
| CPE | cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:* | |
| References | () https://fenrisk.com/rce-centos-webpanel - Exploit, Third Party Advisory | |
| References | () https://control-webpanel.com/changelog - Release Notes | |
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 - US Government Resource |
04 Nov 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-19 18:15
Updated : 2025-11-05 14:07
NVD link : CVE-2025-48703
Mitre link : CVE-2025-48703
CVE.ORG link : CVE-2025-48703
JSON object : View
Products Affected
control-webpanel
- webpanel
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')