Critical severity9.0CISA KEVNVD Advisory· Published Sep 19, 2025· Updated Jun 17, 2026

CVE-2025-48703

Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Control Webpanel/Webpanel
cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
Range: <0.9.8.1205
Control By Web/CentOS Web Panelllm-create
Range: <0.9.8.1205
Vesta Control Panel/Vesta Control Panelllm-fuzzy
Range: <0.9.8.1205
Centos Web Panel/Centos Web Panelcpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

fenrisk.com/rce-centos-webpanelnvdExploitThird Party Advisory
control-webpanel.com/changelognvdRelease Notes
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials
SecurityWeek · May 8, 2026
New PCPJack worm steals credentials, cleans TeamPCP infections
BleepingComputer · May 7, 2026
PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems
The Hacker News · May 7, 2026

cvss	0.585
epss	0.080
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000