CVE-2025-48703

centos-webpanel CentOS Web Panel

Published 19 Sept 2025 · updated 17 Jun 2026 · Analyzed

9.0 Critical · CVSS 3.1, mitre.org

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 4 Nov 2025, with a remediation deadline of 25 Nov 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

References

fenrisk.com/rce-centos-webpanel · Exploit, Third Party Advisory
control-webpanel.com/changelog · Release Notes
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 · US Government Resource