Paper/Archive/CVE-2025-48703

CVE-2025-48703

centos-webpanel CentOS Web Panel — CWP Control Web Panel OS Command Injection Vulnerability

KEV · due 25 Nov EPSS 100%public exploit SSVC act CVSS 9.0

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 In CISA KEV+3030.0 EPSS percentile 100.01.000 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Affected

ProductAffectedFixed inSource

CentOS Web Panel< 0.9.8.12050.9.8.1205CNA

Scores by source

mitre (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

reffenrisk.com/rce-centos-webpanel refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 refcontrol-webpanel.com/changelog kevcisa.gov/known-exploited-vulnerabilities-catalog