CVE-2026-124020

HighCVSS 8.1/10Last modified Nov 13, 2026

Description

Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1240218.1Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/i CVE-2026-124023Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser ret CVE-2026-1240254.3Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint tha CVE-2026-1240264.3Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered u CVE-2026-1240277.5ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthentic CVE-2026-1240284.2mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing CVE-2026-1240295.7Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escap CVE-2026-1240305.5GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS CVE-2026-1240315.5GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appe CVE-2026-1240336.4The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversa CVE-2026-1240346.4Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated u CVE-2026-1240357.1Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user w