CVE-2025-48703

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Score

CVSS 3.1 9.0 Critical

Status

Analyzed - cve@mitre.org

Published

2025-09-19

Last modified

2026-02-26

Known exploited (CISA KEV)

since 2025-11-04, action due 2025-11-25: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-78

Affected products

• Centos Web Panel (Centos-webpanel)
• Webpanel (Control-webpanel)

References

• https://fenrisk.com/rce-centos-webpanel
• https://control-webpanel.com/changelog
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703