CVE-2025-48703: CWP Control Web Panel command injection in filemanager changePerm

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE in an internet-facing hosting panel, with KEV listing and near-certain EPSS exploitation probability, makes this an urgent patch.

What it is

CWP (Control Web Panel) before 0.9.8.1205 fails to sanitize the t_total parameter in a filemanager changePerm request, allowing shell metacharacters to be injected into an OS command. An unauthenticated attacker who knows a valid non-root username can execute arbitrary commands on the server. Because CWP is a hosting control panel, compromise exposes the panel and potentially every hosted site on the box.

Impact

An attacker gains remote code execution with the privileges of the web panel process, enabling full server takeover, data theft, and use of the host as a pivot or bot. Hosted customer sites and credentials on the same server are also at risk.

Attack surface

Reachable over the network through the CWP web interface; no authentication is required, but the attacker must know a valid non-root username. No user interaction is needed.

Exploitation

CVE-2025-48703 is listed in CISA KEV with a 2025-11-25 remediation due date, and EPSS gives a 30-day exploitation probability of 0.99655 (99.9th percentile). A public exploit reference exists, and CISA notes no known ransomware campaign use.

What to do

• Upgrade CWP to 0.9.8.1205 or later immediately; this is the only complete fix.
• If patching is not possible, restrict access to the CWP panel and filemanager endpoints to trusted management IPs or take the panel offline.
• Rotate credentials and SSH keys for all accounts on any server that ran a vulnerable version, and audit for unauthorized accounts or cron jobs.
• Monitor CISA KEV guidance and vendor changelog for follow-up fixes or interim mitigations.
• Segment or rebuild the host if compromise is suspected, since panel-level RCE exposes all hosted tenants.

Detection

• Search web logs for POST requests to filemanager changePerm endpoints with shell metacharacters (;, |, $(), backticks) in the t_total parameter.
• Alert on unexpected child processes spawned by the CWP web server user, especially shells, curl, wget, or nc.
• Review CWP and system authentication logs for logins or account changes from unfamiliar IPs.
• Hunt for new files, cron entries, or outbound connections originating from the panel host after suspicious filemanager activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.