CVE-2025-48703 is a pre-authentication remote code execution vulnerability in CWP (Control Web Panel): an attacker who knows any valid non-root username already configured on the panel can send a crafted filemanager changePerm request that omits the normal authentication check and injects shell metacharacters (e.g. backticks) into the t_total permissions parameter, causing the hosting panel to execute arbitrary commands as that user — no password required.
Vulnerability summary
9
Critical
99.7%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-09-19
Published
Vulnerability ID: CVE-2025-48703 · Source: NVD (MITRE CNA Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| CWP (Control Web Panel / CentOS Web Panel) | cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:* | before 0.9.8.1205 |
What this means
CVE-2025-48703 is an OS command injection vulnerability (CWE-78). NVD's description states: "CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known" (NVD).
The only CVSS data on record is a Secondary score submitted by the MITRE CNA: CVSS v3.1 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. No NVD Primary metric has been published for this CVE as of this check, so this page reports the MITRE figure honestly as not NVD-confirmed rather than attributing it to NVD (NVD).
Research published by fenrisk explains the vulnerability as a chain of two flaws in the panel's /filemanager module: first, the request handler fails to verify that the authenticated session matches the target account and can be made to process requests with the user identifier omitted from the URL; second, the changePerm function passes the t_total parameter (meant to encode numeric file permissions) into a shell command without sanitizing metacharacters, so a value such as `command` executes arbitrary commands with the privileges of the target panel user. Exploitation requires only that the attacker know a valid, already-provisioned non-root username — no credentials for that account are needed. Fenrisk reports the issue was fixed in version 0.9.8.1205, released in June 2025 (fenrisk).
CISA added CVE-2025-48703 to the Known Exploited Vulnerabilities catalog on 2025-11-04, with a required-action due date of 2025-11-25 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.9966 (99.950th percentile), among the highest EPSS scores observed, consistent with a trivially exploitable pre-auth RCE in widely deployed, internet-facing hosting-control-panel software (FIRST EPSS).
Because exploitation requires nothing more than enumerating or guessing a valid panel username, CWP operators should upgrade to 0.9.8.1205 or later immediately, review /filemanager access logs for changePerm requests containing shell metacharacters, and treat any pre-upgrade internet-facing instance as potentially compromised.
Evidence
- CWP before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter of a filemanager changePerm request, given a known valid non-root username. — NVD
- Only CVSS data on record is a MITRE CNA Secondary score, CVSS v3.1 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; no NVD Primary metric published as of this check. — NVD
- Root cause is a chained auth-check bypass (omitting the user identifier from the request URL) plus unsanitized shell-metacharacter injection in the changePerm t_total parameter; fixed in version 0.9.8.1205, released June 2025. — fenrisk
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-11-04, required-action due date 2025-11-25. — CISA KEV
- EPSS score is 0.9966 (99.950th percentile) as of 2026-10-29. — FIRST EPSS
