CVE-2025-48703 CWP Control Web Panel OS Command Injection

What is CVE-2025-48703?

CVE-2025-48703 is a critical command injection vulnerability in Control-Webpanel Webpanel, published on 19 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Weakness: CWE-78

Which versions are affected by CVE-2025-48703?

It affects 1 product.

Products include Control-Webpanel Webpanel.

How do I fix CVE-2025-48703?

No fix has been published for CVE-2025-48703 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Nov 2025.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-48703 being exploited?

Yes. Attackers have exploited CVE-2025-48703 in the wild since at least 4 Nov 2025.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Other vulnerabilities in Control-Webpanel Webpanel

• CVE-2022-44877 CWP Control Web Panel OS Command Injection Exploited Critical 9.8
• CVE-2023-42121 Control Web Panel Missing Authentication Remote Code Execution Vulnerability Critical 9.8
• CVE-2021-45466 Missing authorization in n/a Critical 9.8
• CVE-2021-45467 Missing authorization in n/a Critical 9.8
• CVE-2022-25046 Path traversal in n/a Critical 9.8

All Control-Webpanel Webpanel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vx2w-cj7g-8hcf.