Vulnerability details

CVE-2025-48703

Actively exploited

centos-webpanel CentOS Web Panel

CVSS 3.1

9.0Critical

Remedy

Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-11-25)

Versions not listed as affected in the CVE record:

CentOS Web Panel — version 0.9.8.1205 and later

Official description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

CVSS scores

Score	Version	Source	Vector
9.0Critical	3.1	CVEProject cvelistV5 (CNA) (mitre)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
centos-webpanel	CentOS Web Panel	v < 0.9.8.1205	CVEProject cvelistV5 (CNA)

References and advisories

https://fenrisk.com/rce-centos-webpanel
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 government-resource
https://control-webpanel.com/changelog mitigation

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-09-19
Last updated: 2026-02-26
State: Published
Assigner (CNA): mitre
Kolun priority: 79 · High

CISA KEV catalog

Date added: 2025-11-04
Due date: 2025-11-25
Used in ransomware: Unknown

Exploit prediction (EPSS)

99.65%

Probability of exploitation in 30 days

99.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')