CVE-2026-34234

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.

• CWE-78
• CWE-284

• https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0
• https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-jmhr-q9q5-fqwh
• https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-jmhr-q9q5-fqwh

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34228Emlog is an open source website building system. Prior to ve…6.5
• CVE-2026-34229Emlog is an open source website building system. Prior to ve…6.1
• CVE-2026-34230Rack is a modular Ruby web server interface. Prior to versio…7.5
• CVE-2026-34231Slippers is a UI component framework for Django. Prior to ve…6.1
• CVE-2026-34232Firebird is an open-source relational database management sy…7.5
• CVE-2026-34233CtrlPanel is open-source billing software for hosting provid…6.5
• CVE-2026-34235PJSIP is a free and open source multimedia communication lib…9.1
• CVE-2026-34236Auth0-PHP is a PHP SDK for Auth0 Authentication and Manageme…9.8
• CVE-2026-34237MCP Java SDK is the official Java SDK for Model Context Prot…6.1
• CVE-2026-34238ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-34239Chamilo version 1.11.40 and earlier are vulnerable to authen…7.5
• CVE-2026-34240JOSE is a Javascript Object Signing and Encryption (JOSE) li…7.5