CVE-2026-77876

CVE-2026-77876 is an OS command injection vulnerability affecting Control Web Panel (CWP) versions prior to webpanel_version 1.16. The flaw resides within the `protected_directory` user panel module, specifically involving the `file` POST parameter used during the `acc=deletedp` action. Because the application fails to properly sanitize or escape this parameter before passing it directly into a `shell_exec` call, attackers can submit unescaped input to execute arbitrary commands. Exploiting this vulnerability allows attackers to achieve arbitrary code execution within the context of the user panel. The attack vector is network-based, requiring no user interaction or special privileges to execute. To mitigate this issue, users are advised to update their Control Web Panel installations to version 1.16 or later, where the input validation and escaping mechanisms have been addressed.