CWP Control Web Panel OS Command Injection Vulnerability

CWP Control Web Panel

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Added to CISA KEV on 2025-11-04 (federal deadline 2025-11-25).

First seen: 4 Nov 2025
Last update: 4 Nov 2025, 12:00 UTC
Identifiers: CVE-2025-48703
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## CWP Control Web Panel OS Command Injection Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: CWP Control Web Panel
Ids: CVE-2025-48703

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Added to CISA KEV on 2025-11-04 (federal deadline 2025-11-25).

## Steps
1. Search the repo, its CI and infra config for CWP Control Web Panel. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-48703") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://control-webpanel.com/changelog https://nvd.nist.gov/vuln/detail/CVE-2025-48703
https://pwned.coffee/i/cwp-control-web-panel-os-command-injection-vulnerability-cve-2025-48703

Sources

Totalone hot coffee