CtrlPanel, an open‑source billing system, contains an authenticated Remote Code Execution flaw. The admin settings update endpoint accepts a fully qualified class name directly from the request payload and uses it for dynamic static method calls and object instantiation without any allowlist validation. This corresponds to CWE‑470, allowing an authenticated administrator to name any autoloadable class in the application or its dependencies. By selecting a class whose constructor or magic methods have side effects, an attacker can trigger arbitrary code execution, potentially compromising the entire hosting environment.

The vulnerability affects CtrlPanel‑gg:panel, specifically all releases up to and including version 1.1.1. The flaw was mitigated in the 1.2.0 release, which removes the unvalidated dynamic class loading from the settings update flow.

The CVSS score of 6.6 indicates a moderate severity, and the issue is not listed in CISA KEV. EPSS data is not available, so the exploitation likelihood cannot be quantified. Nonetheless, because the flaw requires authenticated admin access and a valid HTTP request to the update endpoint, the attack surface is limited to administrators with network connectivity to the panel. If exploited, an attacker can execute arbitrary PHP code, leading to full system compromise. No public exploit has been documented, but the absence of a mitigation in earlier releases means any deployed instance is vulnerable until patched.