CVE-2025-48703: CWP Control Web Panel OS Command Injection Vulnerability

Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2025-11-04. EPSS: 99.7% chance of exploitation in the next 30 days.

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Affected products

• Control-Webpanel Webpanel: before 0.9.8.1205 (fixed in 0.9.8.1205)

Published 2025-09-19. Last modified 2026-06-17.