CVE-2025-48703 — centos-webpanel / CentOS Web Panel

CVE-2025-48703

centos-webpanel / CentOS Web Panel PUBLISHED

Description (CNA)

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Affected (CNA)

Vendor / product	Versions
centos-webpanel / CentOS Web Panel	affected 0 before 0.9.8.1205

CWE

CWE-78

References

https://fenrisk.com/rce-centos-webpanel

ADP enrichment

CISA-ADP

No English description supplied.

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703
https://control-webpanel.com/changelog