CentOS Web Panel - Authorization Bypass (CVE-2021-45467)
Description
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.
psychologyCrowdSec Analysis
CVE-2021-45467 is a critical vulnerability in CWP (Control Web Panel) before version 0.9.8.1107 that allows unauthenticated attackers to exploit null byte injection in /user/loader.php, enabling them to register arbitrary API keys. This flaw can be leveraged for remote code execution, unauthorized access, or further compromise of the affected server.
CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2021-45467 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /user/index.php and /user/login.php endpoints by injecting null bytes (%00) and directory traversal sequences into the scripts parameter to access sensitive files or execute arbitrary actions. These requests often contain multiple .%00%00%00./ patterns targeting files like /etc/passwd.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-12-26 |
| Rule Released | 2025-11-26 |
| CrowdSec First Seen | 2026-01-05 |