Vulnerability · CVE-2026-34234
CtrlPanel is open-source billing software for hosting providers.
Published May 19, 2026 · corrected/updated Jul 24, 2026 · Ctrlpanel-gg panel · evidence confidence very high
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-34234 is a critical public vulnerability record for Ctrlpanel-gg panel. CISA lists it as known exploited. Published remediation guidance: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether Ctrlpanel-gg panel is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: Ctrlpanel-gg panel. Published remediation guidance: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 10.0, EPSS 4.5%. CISA lists it as known exploited. Weakness classes: CWE-284, CWE-78. Sources contributing to this record: cve_org, epss, nvd, vulncheck_kev. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Confirmed in CISA KEV since May 19, 2026. Listed in CISA KEV and VulnCheck KEV.
Patch and remediation
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 19, 2026 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
May 19, 2026 · NIST NVD
Detected
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass u
Jul 24, 2026 · NIST NVD
Updated
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass u
Affected
- vendor Ctrlpanel-gg panelversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-34234
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-34234
30-day exploitation probability 4.5%
first.org - NIST NVDVulnerability recordCVE-2026-34234
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and exec
nvd.nist.gov - VulnCheck KEVConfirmed exploitationCVE-2026-34234
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and exec
vulncheck.com