Control Web Panel Unauthenticated Pre-Auth RCE and Root Escalation

VulnCheck has identified a critical vulnerability chain affecting Control Web Panel (CWP), formerly known as CentOS Web Panel, which is widely used across approximately 118,000 internet-facing servers. The core issue, dubbed CWP2Shell, stems from a failure in the user-panel dispatcher to stop execution after issuing a login redirect for unauthenticated requests. This allows an attacker to execute an 'Execution After Redirect' (EAR) attack to include arbitrary PHP modules and execute code as a hosting user account.

Technically, the attack chain begins with CVE-2026-73695 (unauthenticated local file inclusion) and CVE-2026-73696 (missing exit after redirect). Once a foothold is established as a hosting user, the attacker can leverage vulnerabilities in CWP's root-owned loopback API (127.0.0[.]1:2302) to escalate privileges to root. These include ungated routes (CVE-2026-77877) and command injections (CVE-2026-77878, CVE-2026-104080) that run directly in a root shell.

This intelligence is highly urgent as CWP has a history of mass exploitation (e.g., CVE-2025-48703), and the current chain bypasses previous patches. Organizations utilizing CWP must upgrade to version 1.29 or higher immediately to mitigate these risks. Failure to do so leaves servers exposed to full takeovers where an attacker only requires a valid account name (easily enumerable) to achieve root shell access.