# CVE-2026-77876: Control Web Panel OS command injection in protected_directory

Source: https://junglewise.ai/threats/cve-2026-77876-control-web-panel-cwp-before-webpanel-version-1-16-contains-an-os  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-77876 · Severity: critical · CVSS 9.8 · Published 2026-11-02

Control Web Panel is a Linux hosting control panel used to manage web servers and accounts. An OS command injection vulnerability in the protected_directory module allows attackers to execute arbitrary commands on the server by manipulating input to the file deletion function. An attacker can gain complete code execution on the hosting server, potentially compromising all hosted websites and data.

Technologies: [Control Web Panel](https://junglewise.ai/threats/technologies/control-web-panel-control-web-panel). Vendors: [Control Web Panel](https://junglewise.ai/threats/vendors/control-web-panel).

## Quick answers

**Is CVE-2026-77876 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77876 being exploited in the wild.

**How severe is CVE-2026-77876?** Critical severity, with a CVSS score of 9.8, published 2 November 2026.

**Which products and versions are affected?** Control Web Panel before 1.16.

**Is there a fix for CVE-2026-77876?** Yes: fixed in 1.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77876 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77876?** Check whether you run Control Web Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.16

## Technical details

The vulnerability is an OS command injection (CWE-78) in the protected_directory user panel module where the acc=deletedp action passes unescaped user input from the file POST parameter directly to shell_exec without sanitization. This allows authenticated or unauthenticated network attackers to inject shell metacharacters and execute arbitrary commands with the privileges of the web panel process. A fix is available in version 1.16 and later.

## Affected products

- Control Web Panel Control Web Panel before 1.16

## Timeline

- 2026-11-02: disclosed

## References

- [https://control-webpanel.com/changelog](https://control-webpanel.com/changelog)
- [https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory](https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory)

## Related threats

- [Control Web Panel SQL injection in unauthenticated API route](https://junglewise.ai/threats/cve-2026-77881-control-web-panel-cwp-before-webpanel-version-1-30-contains-a)
- [Control Web Panel OS command injection in password change API](https://junglewise.ai/threats/cve-2026-77880-control-web-panel-cwp-before-webpanel-version-1-16-contains-an-os)
- [Control Web Panel OS command injection in database restore API](https://junglewise.ai/threats/cve-2026-77878-control-web-panel-cwp-before-webpanel-version-1-30-contains-an-os)
- [Control Web Panel missing authentication in loopback API](https://junglewise.ai/threats/cve-2026-77877-control-web-panel-cwp-before-webpanel-version-1-30-contains-a)
- [Control Web Panel OS command injection in loopback API](https://junglewise.ai/threats/cve-2026-104080-control-web-panel-cwp-before-webpanel-version-1-30-contains-an)