Detections
Analytics

CVE-2025-48703

critical

Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

References

https://www.securityweek.com/pcpjack-worm-removes-teampcp-infections-steals-credentials/

https://www.bleepingcomputer.com/news/security/new-pcpjack-worm-steals-credentials-cleans-teampcp-infections/

https://thehackernews.com/2026/05/pcpjack-credential-stealer-exploits-5.html

https://www.securityweek.com/cisa-warns-of-cwp-vulnerability-exploited-in-the-wild/

https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-centos-web-panel-bug-exploited-in-attacks/

https://securityaffairs.com/184226/security/u-s-cisa-adds-gladinet-centrestack-and-cwp-control-web-panel-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2025/11/04/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://github.com/137f/PoC-CVE-2025-48703

https://github.com/itstarsec/CVE-2025-48703

https://github.com/trh4ckn0n/CVE-2025-48703

https://github.com/PuddinCat/GithubRepoSpider

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703

https://fenrisk.com/rce-centos-webpanel

https://control-webpanel.com/changelog

Details

Source: Mitre, NVD

Published: 2025-09-19

Updated: 2025-11-05

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.99655