Is CVE-2026-104080 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104080?

CVE-2026-104080 has a CVSS v3 severity of HIGH (8.4).

Back

CVE-2026-104080

Description

Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.