Overview of CVE-2026-104080: Root OS Command Injection in Control Web Panel's /valid_token/ Loopback API

Introduction

A tokenless route on Control Web Panel's root-owned loopback API passed a raw username straight into shell_exec(), so anything able to talk to that local service could run arbitrary commands as root. On a shared hosting server, that turns a foothold as a single hosting user into control of the underlying system and every account on it.

Control Web Panel (CWP) is a free Linux web hosting control panel developed by LINANTO LLC in Tbilisi, Georgia, since 2013. It is aimed at hosting providers, system administrators and end users, with an optional commercial CWPpro tier for extra tools, support and modules. VulnCheck reported roughly 210,000 hosts in a ZoomEye query and about 23,000 under a stricter Shodan cwpsrv banner criterion. These figures describe reach, not confirmed vulnerable installations. CWP sits in the hosting administration layer underneath many small and mid-sized web properties, and it has a history of command injection flaws that were exploited at scale, so its fixes matter well beyond its own user base.

The affected product is Control Web Panel, not cPanel & WHM.

Technical information

Root cause

The flaw is classified as CWE-78, improper neutralization of special elements used in an OS command. CWP runs a user API bound to 127.0.0.1:2302 as root. One of its routes, /valid_token/, performs no token check at all. Its name suggests otherwise, but no valid token protects the operation. According to VulnCheck, which decoded the ionCube-encoded PHP builds, the route did this:

$user = $app->request->post('user');
shell_exec("grep -c '" . $user . ":' /etc/passwd");

The intent is to count matching account entries in /etc/passwd. The single quotes around $user provide no protection, because the attacker controls the quote characters as well. A value containing a quote closes the quoted argument, and any shell metacharacters that follow introduce additional commands. Because the API process runs as root, so do those commands.

The same untrusted value also reached a concatenated SQL query on the same route:

SELECT * FROM oauth_clients WHERE client_id="$user"

One input, two sinks. CVE-2026-104080 covers the shell sink, and the SQL sink is tracked separately as CVE-2026-77881. Fixing or detecting one should not be treated as evidence the other is handled. VulnCheck observed the vulnerable shell sink live in builds 1.16 through 1.23.

Unauthenticated is not the same as internet exposed

The endpoint has no authentication of its own, but it listens on loopback. That is why the published vectors use a local attack vector:

CVE record vectors:

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The sources do not explain the PR:N versus PR:L discrepancy, and the 7.8 score in the supplied CVE data is not corroborated by any of these records. NIST's own assessment was not yet available on the NVD page. We would rely on the published vectors rather than any single number.

Attack flow

VulnCheck's CWP2Shell research places this bug inside a larger chain. Based on that research:

1. Initial foothold as a hosting user. A separate flaw in the public user panel lets an attacker-controlled module name traverse paths, and a login redirect does not terminate server execution. The server runs the module even though the browser receives a redirect to the login page. This is a distinct finding, not part of CVE-2026-104080, but it is how the researchers obtained hosting-user execution from the outside.
2. Request to the local API. From that position, the attacker sends a POST request to /valid_token/ on 127.0.0.1:2302. No token is required.
3. Breaking out of the quoted argument. The user field carries a quote followed by shell metacharacters, which escape the grep argument in the shell_exec() string.
4. Root execution. The injected command runs as root, compromising the host rather than a single hosting account.

For defenders, closing the public entry path does not by itself remove the local root escalation, and fixing the escalation does not close the entry path. Both need to be fixed.

Patch information

Target version: 1.30 or later. VulnCheck's blog timeline credits the /valid_token/ fix to 1.29, based on code-level analysis. The CVE record, NVD and the VulnCheck advisory list everything before 1.30 as affected. Version 1.30 or later is fixed under both readings. The newest build in the vendor changelog is 1.30.1 LTS (3 Nov 2026), which the vendor describes as another security and stability update.

CWP is closed source and ships as ionCube-encoded PHP, so there is no public commit or diff. The details below come from VulnCheck, which decoded shipped builds, compared the vulnerable route with the fixed one, and checked the result against the vendor changelog.

How the fix works

CWP did not escape each call site or add global authentication to the 2302 app (VulnCheck says there is still no global middleware there). Instead, the 1.27 and 1.29 security releases added shared validation helpers that are called at the start of each sensitive route. For /valid_token/, the relevant helper is cwp_clean_username():

• Allowlist, not blocklist. A username must match the pattern below, and anything containing .. is rejected. Quotes, semicolons, spaces, backticks, $(), pipes and every other shell metacharacter fall outside that set.

^[A-Za-z0-9._-]+$

• First statement, early exit. In the fixed build, the first line of /valid_token/ is $user = cwp_clean_username(...), and the route returns immediately if the cleaned value is empty. Bad input never reaches shell_exec() or the database query.
• One gate, both sinks. Validating once at the entry point closes both the shell injection and the SQL injection on this route.

The vendor's 1.29 changelog describes the change in general terms without naming a CVE or reporter: user login lookups in the user panel internal API "validate all values" and request values "never reach a shell".

Caveats

• The commands still interpolate $user. The SQL query still concatenates the value, and the grep command is protected by the allowlist rather than by escapeshellarg(), a prepared statement, or native PHP that reads /etc/passwd directly in place of the shell call. The fix holds as long as cwp_clean_username() stays strict and runs first. A future change that skips it would reintroduce the bug.
• Related helpers. The same hardening pass added cwp_api_safe_home_path(), which keeps file paths inside /home/<user> using realpath, and cwp_api_as_user(), which runs commands through runuser with escapeshellarg so they execute as the account rather than as root. These close sibling user API bugs fixed in the same release, such as /restoredatabase/ and missing token checks. VulnCheck reports finding no remaining tokenless route that passes POST input into a root shell or root SQL query.
• Verification scope. VulnCheck decoded 1.30, not 1.27 and 1.29 individually. It confirmed that all ten CWP2Shell issues, including this one, are fixed in 1.30 with no regressions, and it inferred the 1.27/1.29 split from the changelog.

Additional hardening

VulnCheck recommends that, even on a fixed build, operators keep the user panel on port 2083 and the administrator panels on 2031/2087 off the public internet wherever possible, behind an allowlist. This shrinks the public entry surface but does not replace upgrading. The reviewed disclosures identified no CVE-specific firewall rule, detection signature or supported manual patch procedure.

Affected systems and versions

• Product: Control Web Panel (CWP) by LINANTO LLC.
• Affected per CVE record, NVD and VulnCheck advisory: all versions before 1.30.
• Fix attribution per VulnCheck blog: 1.29 (inferred from the changelog, since 1.29 was not decoded individually).
• Vulnerable sink observed live: builds 1.16 through 1.23.
• Confirmed fixed: 1.30 (decoded by VulnCheck). The current changelog build is 1.30.1 LTS.
• Vulnerable component: the root-owned user API on 127.0.0.1:2302, route /valid_token/, POST parameter user.
• Relevant exposed surfaces in the broader chain: user panel on 2083, administrator panels on 2031/2087.

Earlier releases fixed parts of the wider chain without closing this sink. Per VulnCheck, 1.12 added termination after the login redirect and a session check before module inclusion. Version 1.16 added module and path restrictions, removed shell sinks, escaped shell arguments and used prepared SQL statements, yet the /valid_token/ shell injection survived into later tested releases. Assess installations against the complete repair set, not against whether they contain an older CWP security update.

Vendor security history

CWP has prior command injection flaws with confirmed exploitation:

For CVE-2022-44877, patches shipped in October 2022, a public proof of concept appeared on January 3, 2023, and Shadowserver reported exploitation starting January 6, followed by warnings from GreyNoise and Shadowserver about active attempts. A fix existed well before exploitation accelerated on the back of public technical details.

On the other side of the ledger, the vendor's 1.27 changelog describes an administrator module security review covering command injection, SQL injection, path traversal, XSS and missing CSRF protection. It also lists authentication and validation changes in APIs, including removal of root shell handling of user input and passwords in the user panel API's MySQL Manager. VulnCheck reports all ten CWP2Shell issues fixed in 1.30. The record supports neither a picture of an unresponsive vendor nor the assumption that intermediate security releases fully addressed the disclosed surface.

For CVE-2026-104080 specifically, the reviewed sources do not establish exploitation in the wild, and no threat actor is named. The retrieved CISA KEV view for CWP does not include it, though that is not proof it has never been exploited. The historical KEV entries describe the product's risk profile, but they are not evidence about this CVE. The issue was found by Valentin Lobstein (Chocapikk) of VulnCheck.

References

• NVD: CVE-2026-104080
• CVE Record: CVE-2026-104080
• VulnCheck Advisory: Control Web Panel (CWP) before 1.30 OS Command Injection via valid_token
• VulnCheck Blog: CWP2Shell, The Login Page That Never Says No
• Control Web Panel Changelog
• NVD API record for CVE-2026-104080
• CISA Known Exploited Vulnerabilities Catalog, CWP entries
• NVD: CVE-2025-48703
• SecurityWeek: Exploitation of Control Web Panel Vulnerability Starts After PoC Publication
• Control Web Panel home page
• Control Web Panel: About Us
• Control Web Panel: Installation Instructions