Executive brief
CtrlPanel is an open-source billing and management platform used by web hosting providers. A security flaw in the administrative settings module allows an authorized administrator to force the server to run unintended code by manipulating how the application loads internal components. If exploited, this could allow an attacker with administrative access to take full control of the server, potentially leading to the theft of customer data or a complete shutdown of the hosting service.
Technical details
An unsafe reflection vulnerability exists in `app/Http/Controllers/Admin/SettingsController.php` within the `update()` method. The application reads the `settings_class` parameter directly from an HTTP request and uses it to instantiate objects and call static methods (e.g., `new $settings_class()`) without validation. An authenticated attacker with administrative privileges can provide any class name available via the Composer autoloader. By leveraging PHP magic methods such as `__construct`, `__toString`, or `__wakeup` in available gadget chains, an attacker can achieve remote code execution (RCE). The vulnerability is mitigated in version 1.2.0 by implementing a server-side map that validates the requested class against an allowlist of legitimate settings classes.
Affected products
- CtrlPanel-gg CtrlPanel <= 1.1.1
Timeline
- 2026-04-24: patched: Fixed in version 1.2.0
- 2026-05-08: advisory: GitHub Security Advisory GHSA-vcg3-fjrx-rg5q published
- 2026-05-19: disclosed: CVE-2026-34216 published to NVD