A loopback API endpoint in Control Web Panel versions prior to 1.30 disallows validation of the 'user' parameter before passing it to a shell_exec call. The consequence is an OS command injection that can be triggered by any unauthenticated client. Successful exploitation yields execution of arbitrary shell commands with the privileges of the web server process, effectively granting root access to the underlying operating system and compromising confidentiality, integrity, and availability of the entire host.

All installations of Control Web Panel older than version 1.30 are affected. Administrators should verify the exact installed version and upgrade when possible.

The CVSS score of 8.6 places this flaw in the high‑severity category, and although EPSS data is missing, the lack of authentication requirements and the use of a web API suggests that a remote attacker could trigger it by sending a crafted HTTP request to /valid_token/. The vulnerability is not listed in CISA’s KEV catalog, but the root‑level code execution capability indicates a high exploitation likelihood if the panel is exposed to the network.