CVE-2026-34234

CRITICAL

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execu...

Affects 0 products across 1 vendor.

CVSS 3.110.0
EPSS4.5%
Percentile91th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

CWE-284: Improper Access Control

Software does not restrict or incorrectly restricts access to a resource.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-478 Modification of Windows Service Configuration
via CWE-284
CAPEC-479 Malicious Root Certificate
via CWE-284
CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment
via CWE-284
Show all 22
via CWE-78
via CWE-78
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

CtrlPanel versions 1.1.1 and prior are vulnerable to unauthenticated Remote Code Execution (RCE) due to improper handling of the install.lock check in the web-based installer.

BSID: BS-2026-GLOBAL-151150-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-34234?
CtrlPanel versions 1.1.1 and prior are vulnerable to unauthenticated Remote Code Execution (RCE) due to improper handling of the install.lock check in the web-based installer.
What is the CVSS score for CVE-2026-34234?
CVE-2026-34234 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 4.5%.
Is CVE-2026-34234 actively exploited?
No confirmed active exploitation of CVE-2026-34234 as of 2026-07-25.
How do I remediate CVE-2026-34234?
Priority: IMMEDIATE.
What systems are affected by CVE-2026-34234?
CVE-2026-34234 affects Form.
Vulnerability Details
CVE IDCVE-2026-34234
BSIDBS-2026-GLOBAL-151150-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2026-05-19
Last Modified2026-07-24
ICS Relevance15%
Weakness (CWE)
OS Command InjectionImproper Access Control
SourceNVD
Official Description

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the public/installer/index.php file, where form handler files are included and executed before the install.lock check is performed. This allows attackers to reach installer endpoints on already-installed instances and potentially execute arbitrary code.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Form — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 149 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashbb10196081a5b838f6eebb3224ab6afcfa358e9fc78f95bebcda02c9cd5af54af9d18d2e50f69ddb5d46ca046f315e5b0ee4f12a8eef2ead5d0f090bd06572ae
Related CVEs affecting Form
CVE-2024-50484 10.0 Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahl... CVE-1999-0935 10.0 classifieds.cgi allows remote attackers to execute arbitrary commands by spec... CVE-1999-0937 10.0 BNBForm allows remote attackers to read arbitrary files via the automessage h... CVE-2025-68271 10.0 OpenC3 COSMOS provides the functionality needed to send commands to and recei... CVE-2025-53283 10.0 Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor D...
View all Form CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →