CVE-2026-104080 | Control Web Panel up to 1.29 Loopback API shell_exec user os command injection

November 2, 2026 Yanac

A vulnerability, which was classified as critical, was found in Control Web Panel up to 1.29. The affected element is the function shell_exec of the component Loopback API. Executing a manipulation of the argument User can lead to os command injection.

This vulnerability is handled as CVE-2026-104080. The attack can be executed remotely. There is not any exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More