Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-34234

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.

Vector	NETWORK
Published	May 19, 2026, 22:16
Published By	security-advisories@github.com

Base Score

Affected Versions

No affected versions found.

References

Weakness Type

CWE-78

CVSS Metrics

Base Score	10
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Severity	Critical
Version	3.1
Attack Vector (AV)	NETWORK

Moole Vulnerability Database

Find real vulnerabilities before they ship