CVE-2026-34234

Vulnerability

CtrlPanel versions 1.1.1 and prior contain a critical vulnerability in the web-based installer (public/installer/index.php). The installer includes and executes form handler files before checking for the presence of install.lock, meaning installer endpoints remain reachable on already-installed instances. Additionally, user-supplied input is passed unsanitized into shell commands via run_console() in src/forms/smtp.php and src/functions/shell.php, leading to Remote Code Execution (RCE). This issue is reported to be actively exploited in the wild [1].

Exploitation

An unauthenticated attacker with network access to the CtrlPanel instance can send crafted POST requests to the installer endpoints. By submitting a payload such as asdasd'' && bash -c 'malicious_command' in the $value parameter, the attacker can break out of the single-quoted context in the shell command and execute arbitrary commands. The exploitation does not require any prior authentication or user interaction [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the web server process. The attacker can achieve full compromise of the server, including data exfiltration, installation of backdoors, or lateral movement within the hosting environment. The vulnerability is rated CVSS 10.0 (Critical) [1].

Mitigation

The issue is fixed in version 1.2.0, released on 2026-05-19 [2]. Users must upgrade to version 1.2.0 immediately. No workaround is available for unpatched instances. The vulnerability is actively exploited, and CISA has not yet listed it in KEV as of the publication date [1][2].