Threats tagged 'ghsa-xxpw-8v5c-fcm7'

Control Web Panel (CWP) versions before 1.30 contain an OS command injection vulnerability in the loopback API database restore route (/v1/restoredatabase/). The vulnerability arises because the restoreDBBackup() handler passes an attacker-controlled file path from the POST body directly into a shell command without proper escaping. An attacker who can access this route can execute arbitrary OS commands with root privileges.