CVE-2025-48703

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

CVSS v3.1

9.0 CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

99.66% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-11-04

Nuclei

critical · CWE-78

Published

2025-09-19

Updated

2026-02-26

Proof-of-concept exploits (2)

• Skynoxk/CVE-2025-487033★ · 2025-06-28
• itstarsec/CVE-2025-487030★ · 2026-06-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48703.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-40554
• CVE-2026-27944
• CVE-2020-0618
• CVE-2025-4870
• CVE-2025-48705
• CVE-2025-4869