CtrlPanel CVE-2026-34234: Brief Summary of a Critical Unauthenticated RCE in the Web Installer

Introduction

An unauthenticated remote code execution vulnerability in CtrlPanel's web installer is being actively exploited in the wild. Attackers need zero credentials to get full command execution on hosting provider infrastructure. The flaw, scored at CVSS 10.0, affects all CtrlPanel instances running version 1.1.1 or earlier where the installer directory remains accessible.

CtrlPanel is an open-source billing and management dashboard designed to integrate with Pterodactyl hosting panels. It is built for both new and experienced hosting providers and offers dynamic server billing, automatic server suspension, and Discord integration. Because CtrlPanel sits at the intersection of billing and server management, a compromise can cascade into control over the underlying hosting infrastructure.

Technical Information

CVE-2026-34234 is classified under CWE-78 (OS Command Injection) and CWE-284 (Improper Access Control). It comes from two distinct architectural weaknesses in the installer logic. Combined, they produce an unauthenticated RCE chain that is trivial to exploit.

Premature Form Handler Execution

In versions 1.1.1 and earlier, the installer script at public/installer/index.php includes and executes form handler files, and only after that checks for the presence of the install.lock file. Because of this ordering mistake, the form logic is active on every request, whether or not the application has already been fully installed. Any unauthenticated attacker can submit crafted POST requests to installer endpoints on a production instance.

Unsanitized Shell Command Construction

The second weakness lives in the form handlers themselves. In src/forms/smtp.php, user-supplied values are interpolated directly into a shell command string with no escaping:

run_console("php artisan settings:set 'MailSettings' '$key' '$value'",...);

The run_console() function in src/functions/shell.php then passes the constructed command and working directory path to proc_open via bash -c, again without escaping:

$handle = proc_open("cd '$path' && bash -c 'exec -a ServerCPP $command'",...);

Attack Flow

The exploitation path is straightforward:

1. The attacker identifies a CtrlPanel instance by requesting the well-known /installer path. The official CtrlPanel documentation tells users to install via this exact URL, so internet scanning makes discovery trivial.

2. Because the install.lock check runs after the form handlers are loaded, the attacker can submit POST requests to the SMTP configuration form handler on a fully deployed instance.

3. The attacker submits a crafted payload that breaks out of the single-quoted shell context. A documented exploit payload takes the form:

asdasd'' && bash -c 'malicious_command'

4. This payload terminates the intended shell argument and appends an arbitrary command. The injected command executes with the privileges of the web server process.

5. From this position, the attacker can read .env files containing database credentials and application secrets, establish persistence, and pivot laterally across the network.

At no step does the attacker need authentication, session tokens, or prior knowledge of the target system.

Affected Systems and Versions

Any CtrlPanel deployment where the public/installer/ directory is accessible over the network is exploitable. This includes instances where installation was completed but the installer files were not removed or restricted, which is the default state.

Vendor Security History

CtrlPanel has a formal security policy in its GitHub repository that directs users to report vulnerabilities privately rather than through public issues. In response to CVE-2026-34234, the vendor released version 1.2.0 and published a detailed security advisory (GHSA-jmhr-q9q5-fqwh) covering the root cause and remediation steps. The turnaround from disclosure to patch release was reasonably responsive. Even so, the flaw was actively exploited before the patch was available, which shows how hard it is for open-source projects to fix critical vulnerabilities before they are weaponized.

References

• NVD Entry for CVE-2026-34234
• CVE Record for CVE-2026-34234
• GitHub Security Advisory GHSA-jmhr-q9q5-fqwh
• CtrlPanel Release 1.2.0
• CtrlPanel GitHub Repository
• CtrlPanel Documentation: Introduction
• CtrlPanel Documentation: Getting Started