CVE-2026-34234
CWE-78Published: May 19, 2026· Updated: May 20, 2026
Official Description
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.
Risk Analysis
This critical vulnerability in CtrlPanel billing software allows unauthenticated remote code execution due to an insecure installer and unsanitized user input. With a perfect CVSS score of 10.0, this flaw is extremely severe. Its confirmed active exploitation in the wild and inclusion in CISA's KEV catalog make it an immediate and critical threat.
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. It is remotely exploitable without authentication and has low attack complexity.
Upgrade CtrlPanel to a version beyond 1.1.1 to patch this critical remote code execution vulnerability. Ensure that web-based installers are properly secured and removed or disabled after installation.
Technical Analysis
CVE-2026-34234 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CISA has added CVE-2026-34234 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (3)
Quick Facts
Related CVEs (CWE-78)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-34234 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1